Work on RLCMAC layer. Integration of scheduler and new packet transfer

11 files changed, 349 insertions, 200 deletions

diff --git a/src/Makefile.am b/src/Makefile.am
index db1f87f9..4f8a548c 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -33,6 +33,8 @@ libgprs_la_SOURCES = \
 	gsm_rlcmac.cpp \
 	gprs_bssgp_pcu.cpp \
 	gprs_rlcmac.cpp \
+	gprs_rlcmac_data.cpp \
+	gprs_rlcmac_sched.cpp \
 	gsm_timer.cpp \
 	bitvector.cpp
 
diff --git a/src/gprs_bssgp_pcu.cpp b/src/gprs_bssgp_pcu.cpp
index 4cc69e4f..85fef64d 100644
--- a/src/gprs_bssgp_pcu.cpp
+++ b/src/gprs_bssgp_pcu.cpp
@@ -35,20 +35,15 @@ int gprs_bssgp_pcu_rx_dl_ud(struct msgb *msg, struct tlv_parsed *tp)
 	budh = (struct bssgp_ud_hdr *)msgb_bssgph(msg);
 	struct gprs_rlcmac_tbf *tbf;
 	// Create new TBF
-	tfi = tfi_alloc();
+	tfi = tfi_alloc(&trx, &ts);
 	if (tfi < 0) {
-		return tfi;
-	}
-
-	/* FIXME: select right TRX/TS */
-	if (select_pdch(&trx, &ts)) {
 		LOGP(DRLCMAC, LOGL_NOTICE, "No PDCH ressource\n");
 		/* FIXME: send reject */
 		return -EBUSY;
 	}
 	tbf = tbf_alloc(tfi, trx, ts);
 	tbf->direction = GPRS_RLCMAC_DL_TBF;
-	tbf->state = GPRS_RLCMAC_WAIT_DATA_SEQ_START;
+	tbf->state = GPRS_RLCMAC_FLOW;
 	tbf->tlli = ntohl(budh->tlli);
 	LOGP(DRLCMAC, LOGL_NOTICE, "TBF: [DOWNLINK] START TFI: %u TLLI: 0x%08x \n", tbf->tfi, tbf->tlli);
 
@@ -60,13 +55,13 @@ int gprs_bssgp_pcu_rx_dl_ud(struct msgb *msg, struct tlv_parsed *tp)
 	}
 
 	uint8_t *llc_pdu = (uint8_t *) TLVP_VAL(tp, BSSGP_IE_LLC_PDU);
-	tbf->data_index = TLVP_LEN(tp, BSSGP_IE_LLC_PDU);
+	tbf->llc_index = TLVP_LEN(tp, BSSGP_IE_LLC_PDU);
 	
 	LOGP(DBSSGP, LOGL_NOTICE, "LLC PDU = ");
-	for (i = 0; i < tbf->data_index; i++)
+	for (i = 0; i < tbf->llc_index; i++)
 	{
-		tbf->rlc_data[i] = llc_pdu[i];
-		LOGPC(DBSSGP, LOGL_NOTICE, "%02x", tbf->rlc_data[i]);
+		tbf->llc_frame[i] = llc_pdu[i];
+		LOGPC(DBSSGP, LOGL_NOTICE, "%02x", tbf->llc_frame[i]);
 	}
 
 	uint16_t imsi_len = 0;
@@ -86,6 +81,7 @@ int gprs_bssgp_pcu_rx_dl_ud(struct msgb *msg, struct tlv_parsed *tp)
 
 	gprs_rlcmac_packet_downlink_assignment(tbf);
 
+	return 0;
 }
 /* Receive a BSSGP PDU from a BSS on a PTP BVCI */
 int gprs_bssgp_pcu_rx_ptp(struct msgb *msg, struct tlv_parsed *tp, struct bssgp_bvc_ctx *bctx)
diff --git a/src/gprs_bssgp_pcu.h b/src/gprs_bssgp_pcu.h
index 07f11736..dd9022f7 100644
--- a/src/gprs_bssgp_pcu.h
+++ b/src/gprs_bssgp_pcu.h
@@ -50,8 +50,8 @@ struct bssgp_bvc_ctx *btsctx_alloc(uint16_t bvci, uint16_t nsei);
 #define BLOCK_LEN 23
 
 #define CELL_ID 0
-#define MNC 1
-#define MCC 001
+#define MNC 2
+#define MCC 262
 #define PCU_LAC 1
 #define PCU_RAC 0
 
diff --git a/src/gprs_debug.cpp b/src/gprs_debug.cpp
index 479e9886..6bf472f6 100644
--- a/src/gprs_debug.cpp
+++ b/src/gprs_debug.cpp
@@ -37,10 +37,11 @@
 static const struct log_info_cat default_categories[] = {
 	{"DCSN1", "\033[1;31m", "Concrete Syntax Notation One (CSN1)", LOGL_NOTICE, 1},
 	{"DL1IF", "\033[1;32m", "GPRS PCU L1 interface (L1IF)", LOGL_NOTICE, 1},
-	{"DRLCMAC", "\033[1;33m", "GPRS RLC/MAC layer (RLCMAC)", LOGL_NOTICE, 1},
-	{"DRLCMACDATA", "\033[1;36m", "GPRS RLC/MAC layer Data (RLCMAC)", LOGL_NOTICE, 1},
+	{"DRLCMAC", "\033[1;33m", "GPRS RLC/MAC layer (RLCMAC)", LOGL_DEBUG, 1},
+	{"DRLCMACDATA", "\033[1;36m", "GPRS RLC/MAC layer Data (RLCMAC)", LOGL_DEBUG, 1},
+	{"DRLCMACSCHED", "\033[0;36m", "GPRS RLC/MAC layer Data (RLCMAC)", LOGL_DEBUG, 1},
 	{"DBSSGP", "\033[1;34m", "GPRS BSS Gateway Protocol (BSSGP)", LOGL_NOTICE , 1},
-	{"DPCU", "\033[1;35m", "GPRS Packet Control Unit (PCU)", LOGL_NOTICE, 1}
+	{"DPCU", "\033[1;35m", "GPRS Packet Control Unit (PCU)", LOGL_NOTICE, 1},
 };
 
 enum {
diff --git a/src/gprs_debug.h b/src/gprs_debug.h
index ee95e19d..5d0c6042 100644
--- a/src/gprs_debug.h
+++ b/src/gprs_debug.h
@@ -31,6 +31,7 @@ enum {
 	DL1IF,
 	DRLCMAC,
 	DRLCMACDATA,
+	DRLCMACSCHED,
 	DBSSGP,
 	DPCU,
 	aDebug_LastEntry
diff --git a/src/gprs_rlcmac.cpp b/src/gprs_rlcmac.cpp
index 8f385ebb..3353462e 100644
--- a/src/gprs_rlcmac.cpp
+++ b/src/gprs_rlcmac.cpp
@@ -1,6 +1,7 @@
 /* gprs_rlcmac.cpp
  *
  * Copyright (C) 2012 Ivan Klyuchnikov
+ * Copyright (C) 2012 Andreas Eversberg <jolly@eversberg.eu>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -26,28 +27,83 @@ LLIST_HEAD(gprs_rlcmac_tbfs);
 void *rlcmac_tall_ctx;
 LLIST_HEAD(block_queue);
 
-int tfi_alloc()
+/* FIXME: spread ressources on multiple TRX */
+int tfi_alloc(uint8_t *_trx, uint8_t *_ts)
 {
-	struct gprs_rlcmac_tbf *tbf;
-	uint32_t tfi_map = 0;
-	uint32_t tfi_ind = 0;
-	uint32_t mask = 1;
-	uint8_t i;
+	struct gprs_rlcmac_bts *bts = gprs_rlcmac_bts;
+	struct gprs_rlcmac_pdch *pdch;
+	uint8_t trx, ts, tfi;
 
-	llist_for_each_entry(tbf, &gprs_rlcmac_tbfs, list) {
-		tfi_ind = 1 << tbf->tfi;
-		tfi_map = tfi_map|tfi_ind;
+	for (trx = 0; trx < 8; trx++) {
+		for (ts = 0; ts < 8; ts++) {
+			pdch = &bts->trx[trx].pdch[ts];
+			if (!pdch->enable)
+				continue;
+			break;
+		}
+		if (ts < 8)
+			break;
+	}
+	if (trx == 8) {
+		LOGP(DRLCMAC, LOGL_NOTICE, "No PDCH available.\n");
+		return -EINVAL;
+	}
+
+
+	LOGP(DRLCMAC, LOGL_DEBUG, "Searching for first unallocated TFI: "
+		"TRX=%d TS=%d\n", trx, ts);
+	for (tfi = 0; tfi < 32; tfi++) {
+		if (!pdch->tbf[tfi])
+			break;
 	}
 	
-	for (i = 0; i < 32; i++) {
-		if(((tfi_map >> i) & mask) == 0) {
-			return i;
+	if (tfi < 32) {
+		LOGP(DRLCMAC, LOGL_DEBUG, " Found TFI=%d.\n", tfi);
+		*_trx = trx;
+		*_ts = ts;
+		return tfi;
+	}
+	LOGP(DRLCMAC, LOGL_NOTICE, "No TFI available.\n");
+
+	return -1;
+}
+
+int find_free_usf(uint8_t trx, uint8_t ts)
+{
+	struct gprs_rlcmac_bts *bts = gprs_rlcmac_bts;
+	struct gprs_rlcmac_pdch *pdch;
+	struct gprs_rlcmac_tbf *tbf;
+	uint8_t usf_map = 0;
+	uint8_t tfi, usf;
+
+	if (trx >= 8 || ts >= 8)
+		return -EINVAL;
+	pdch = &bts->trx[trx].pdch[ts];
+
+	/* make map of used USF */
+	for (tfi = 0; tfi < 32; tfi++) {
+		tbf = pdch->tbf[tfi];
+		if (!tbf)
+			continue;
+		if (tbf->direction != GPRS_RLCMAC_UL_TBF)
+			continue;
+		usf_map |= (1 << tbf->dir.ul.usf);
+	}
+
+	/* look for USF, don't use USF=7 */
+	for (usf = 0; usf < 7; usf++) {
+		if (!(usf_map & (1 << usf))) {
+			LOGP(DRLCMAC, LOGL_DEBUG, " Found USF=%d.\n", usf);
+			return usf;
 		}
 	}
+	LOGP(DRLCMAC, LOGL_NOTICE, "No USF available.\n");
+
 	return -1;
 }
 
 /* lookup TBF Entity (by TFI) */
+#warning FIXME: use pdch instance by trx and ts, because tfi is local
 struct gprs_rlcmac_tbf *tbf_by_tfi(uint8_t tfi)
 {
 	struct gprs_rlcmac_tbf *tbf;
@@ -71,8 +127,17 @@ struct gprs_rlcmac_tbf *tbf_by_tlli(uint32_t tlli)
 
 struct gprs_rlcmac_tbf *tbf_alloc(uint8_t tfi, uint8_t trx, uint8_t ts)
 {
+	struct gprs_rlcmac_bts *bts = gprs_rlcmac_bts;
+	struct gprs_rlcmac_pdch *pdch;
 	struct gprs_rlcmac_tbf *tbf;
 
+	LOGP(DRLCMAC, LOGL_INFO, "********** TBF starts here **********\n");
+	LOGP(DRLCMAC, LOGL_INFO, "Allocating TBF with TFI=%d.\n", tfi);
+
+	if (trx >= 8 || ts >= 8 || tfi >= 32)
+		return NULL;
+	pdch = &bts->trx[trx].pdch[ts];
+
 	tbf = talloc_zero(rlcmac_tall_ctx, struct gprs_rlcmac_tbf);
 	if (!tbf)
 		return NULL;
@@ -80,15 +145,26 @@ struct gprs_rlcmac_tbf *tbf_alloc(uint8_t tfi, uint8_t trx, uint8_t ts)
 	tbf->tfi = tfi;
 	tbf->trx = trx;
 	tbf->ts = ts;
-	tbf->arfcn = pcu_l1if_bts.trx[trx].arfcn;
-	tbf->tsc = pcu_l1if_bts.trx[trx].ts[ts].tsc;
+	tbf->arfcn = bts->trx[trx].arfcn;
+	tbf->tsc = bts->trx[trx].pdch[ts].tsc;
+	tbf->ws = 64;
+	tbf->sns = 128;
 	llist_add(&tbf->list, &gprs_rlcmac_tbfs);
+	pdch->tbf[tfi] = tbf;
 
 	return tbf;
 }
 
 void tbf_free(struct gprs_rlcmac_tbf *tbf)
 {
+	struct gprs_rlcmac_bts *bts = gprs_rlcmac_bts;
+	struct gprs_rlcmac_pdch *pdch;
+
+	LOGP(DRLCMAC, LOGL_INFO, "Free TBF with TFI=%d.\n", tbf->tfi);
+	LOGP(DRLCMAC, LOGL_INFO, "********** TBF ends here **********\n");
+	tbf_timer_stop(tbf);
+	pdch = &bts->trx[tbf->trx].pdch[tbf->ts];
+	pdch->tbf[tbf->tfi] = NULL;
 	llist_del(&tbf->list);
 	talloc_free(tbf);
 }
@@ -98,33 +174,65 @@ static void tbf_timer_cb(void *_tbf)
 {
 	struct gprs_rlcmac_tbf *tbf = (struct gprs_rlcmac_tbf *)_tbf;
 
+	LOGP(DRLCMAC, LOGL_DEBUG, "TBF timer %u expired.\n", tbf->T);
+
 	tbf->num_T_exp++;
 
 	switch (tbf->T) {
-	case 1111:
-		// TODO: We should add timers for TBF.
+	case 3169:
+		LOGP(DRLCMAC, LOGL_DEBUG, "TBF will be freed due to timeout\n");
+		/* free TBF */
+		tbf_free(tbf);
+		break;
+	case 3103:
+		if (++tbf->dir.ul.n3103 == N3103_MAX) {
+			LOGP(DRLCMAC, LOGL_DEBUG, "Final ACK will be resent "
+				"due to timeout\n");
+			/* timeout for polling with final ack message, */
+			/* trigger sending at next RTS */
+			tbf->dir.ul.substate = GPRS_RLCMAC_UL_SEND_ACK;
+		} else {
+			LOGP(DRLCMAC, LOGL_DEBUG, "Too many timeouts on final "
+				"ACK, starting T3169\n");
+			/* restart T3169, so we can be sure that after expiry,
+			 * the mobile has timed out and wiil not transmit
+			 * anymore */
+			tbf->state = GPRS_RLCMAC_RELEASING;
+		        tbf_timer_start(tbf, 3169, T3169);
+		}
 		break;
 	default:
-		LOGP(DRLCMAC, LOGL_NOTICE, "Timer expired in unknown mode: %u \n", tbf->T);
+		LOGP(DRLCMAC, LOGL_ERROR, "Timer expired in unknown mode: %u\n",
+			tbf->T);
 	}
 }
 
-static void tbf_timer_start(struct gprs_rlcmac_tbf *tbf, unsigned int T,
+void tbf_timer_start(struct gprs_rlcmac_tbf *tbf, unsigned int T,
 				unsigned int seconds)
 {
-	if (osmo_timer_pending(&tbf->timer))
-		LOGP(DRLCMAC, LOGL_NOTICE, "Starting TBF timer %u while old timer %u pending \n", T, tbf->T);
+	if (!osmo_timer_pending(&tbf->timer))
+		LOGP(DRLCMAC, LOGL_DEBUG, "Starting TBF timer %u.\n", T);
+	else
+		LOGP(DRLCMAC, LOGL_DEBUG, "Restarting TBF timer %u while old "
+			"timer %u pending \n", T, tbf->T);
 
 	tbf->T = T;
 	tbf->num_T_exp = 0;
 
-	/* FIXME: we should do this only once ? */
+	/* Tunning timers can be safely re-scheduled. */
 	tbf->timer.data = tbf;
 	tbf->timer.cb = &tbf_timer_cb;
 
 	osmo_timer_schedule(&tbf->timer, seconds, 0);
 }
 
+void tbf_timer_stop(struct gprs_rlcmac_tbf *tbf)
+{
+	if (osmo_timer_pending(&tbf->timer)) {
+		LOGP(DRLCMAC, LOGL_DEBUG, "Stopping TBF timer %u.\n", tbf->T);
+		osmo_timer_del(&tbf->timer);
+	}
+}
 
 static void tbf_gsm_timer_cb(void *_tbf)
 {
@@ -159,7 +267,7 @@ static void tbf_gsm_timer_start(struct gprs_rlcmac_tbf *tbf, unsigned int fT,
 	osmo_gsm_timer_schedule(&tbf->gsm_timer, frames);
 }
 
-static void gprs_rlcmac_enqueue_block(bitvec *block, int len)
+void gprs_rlcmac_enqueue_block(bitvec *block, int len)
 {
 	struct msgb *msg = msgb_alloc(len, "rlcmac_dl");
 	bitvec_pack(block, msgb_put(msg, len));
@@ -266,7 +374,7 @@ void  write_packet_uplink_assignment(bitvec * dest, uint8_t tfi, uint32_t tlli)
 
 // GSM 04.08 9.1.18 Immediate assignment
 int write_immediate_assignment(bitvec * dest, uint8_t downlink, uint8_t ra, uint32_t fn,
-								uint8_t ta, uint16_t arfcn, uint8_t ts, uint8_t tsc, uint8_t tfi = 0, uint32_t tlli = 0)
+								uint8_t ta, uint16_t arfcn, uint8_t ts, uint8_t tsc, uint8_t tfi = 0, uint8_t usf = 0, uint32_t tlli = 0)
 {
 	unsigned wp = 0;
 
@@ -332,7 +440,7 @@ int write_immediate_assignment(bitvec * dest, uint8_t downlink, uint8_t ra, uint
 		bitvec_write_field(dest, wp, tfi, 5);  // TFI_ASSIGNMENT Temporary Flow Identity
 		bitvec_write_field(dest, wp, 0, 1);    // POLLING
 		bitvec_write_field(dest, wp, 0, 1);    // ALLOCATION_TYPE: dynamic
-		bitvec_write_field(dest, wp, 1, 3);    // USF
+		bitvec_write_field(dest, wp, usf, 3);    // USF
 		bitvec_write_field(dest, wp, 0, 1);    // USF_GRANULARITY
 		bitvec_write_field(dest, wp, 0 , 1);   // "0" power control: Not Present
 		bitvec_write_field(dest, wp, 0, 2);    // CHANNEL_CODING_COMMAND 
@@ -373,46 +481,7 @@ void write_ia_rest_octets_downlink_assignment(bitvec * dest, uint8_t tfi, uint32
 	bitvec_write_field(dest, wp,0xb,4);
 }
 
-void write_packet_uplink_ack(bitvec * dest, uint8_t tfi, uint32_t tlli, unsigned cv, unsigned bsn)
-{
-	// TODO We should use our implementation of encode RLC/MAC Control messages.
-	unsigned wp = 0;
-	bitvec_write_field(dest, wp,0x1,2);  // payload
-	bitvec_write_field(dest, wp,0x0,2);  // Uplink block with TDMA framenumber
-	if (cv == 0) bitvec_write_field(dest, wp,0x1,1);  // Suppl/Polling Bit
-	else bitvec_write_field(dest, wp,0x0,1);  //Suppl/Polling Bit
-	bitvec_write_field(dest, wp,0x1,3);  // Uplink state flag
-	
-	//bitvec_write_field(dest, wp,0x0,1);  // Reduced block sequence number
-	//bitvec_write_field(dest, wp,BSN+6,5);  // Radio transaction identifier
-	//bitvec_write_field(dest, wp,0x1,1);  // Final segment
-	//bitvec_write_field(dest, wp,0x1,1);  // Address control
-
-	//bitvec_write_field(dest, wp,0x0,2);  // Power reduction: 0
-	//bitvec_write_field(dest, wp,TFI,5);  // Temporary flow identifier
-	//bitvec_write_field(dest, wp,0x1,1);  // Direction
-
-	bitvec_write_field(dest, wp,0x09,6); // MESSAGE TYPE
-	bitvec_write_field(dest, wp,0x0,2);  // Page Mode
-
-	bitvec_write_field(dest, wp,0x0,2);
-	bitvec_write_field(dest, wp,tfi,5); // Uplink TFI
-	bitvec_write_field(dest, wp,0x0,1);
-	
-	bitvec_write_field(dest, wp,0x0,2);  // CS1
-	if (cv == 0) bitvec_write_field(dest, wp,0x1,1);  // FINAL_ACK_INDICATION
-	else bitvec_write_field(dest, wp,0x0,1);  // FINAL_ACK_INDICATION
-	bitvec_write_field(dest, wp,bsn + 1,7); // STARTING_SEQUENCE_NUMBER
-	// RECEIVE_BLOCK_BITMAP
-	for (unsigned i=0; i<8; i++) {
-		bitvec_write_field(dest, wp,0xff,8);
-	}
-	bitvec_write_field(dest, wp,0x1,1);  // CONTENTION_RESOLUTION_TLLI = present
-	bitvec_write_field(dest, wp,tlli,8*4);
-	bitvec_write_field(dest, wp,0x00,4); //spare
-	bitvec_write_field(dest, wp,0x5,4); //0101
-}
-
+#if 0
 void gprs_rlcmac_tx_ul_ack(uint8_t tfi, uint32_t tlli, RlcMacUplinkDataBlock_t * ul_data_block)
 {
 	bitvec *packet_uplink_ack_vec = bitvec_alloc(23);
@@ -496,12 +565,12 @@ void gprs_rlcmac_data_block_parse(gprs_rlcmac_tbf* tbf, RlcMacUplinkDataBlock_t
 			llc_pdu_len = UL_RLC_DATA_BLOCK_LEN - data_block_hdr_len;
 		}
 		
-		for (unsigned i = tbf->data_index; i < tbf->data_index + llc_pdu_len; i++)
+		for (unsigned i = tbf->llc_index; i < tbf->llc_index + llc_pdu_len; i++)
 		{
-			tbf->rlc_data[i] = ul_data_block->RLC_DATA[data_octet_num];
+			tbf->llc_frame[i] = ul_data_block->RLC_DATA[data_octet_num];
 			data_octet_num++;
 		}
-		tbf->data_index += llc_pdu_len;
+		tbf->llc_index += llc_pdu_len;
 		
 		if (ul_data_block->E_1 == 0) // Extension octet follows immediately
 		{
@@ -509,17 +578,17 @@ void gprs_rlcmac_data_block_parse(gprs_rlcmac_tbf* tbf, RlcMacUplinkDataBlock_t
 			if (ul_data_block->M[num] == 1)
 			{
 				gprs_rlcmac_tx_ul_ud(tbf);
-				tbf->data_index = 0;
+				tbf->llc_index = 0;
 				// New LLC PDU continues until the end of the RLC information field, no more extension octets.
 				if ((ul_data_block->E[num] == 1))
 				{
 					llc_pdu_len = UL_RLC_DATA_BLOCK_LEN - data_block_hdr_len - data_octet_num;
-					for (unsigned i = tbf->data_index; i < tbf->data_index + llc_pdu_len; i++)
+					for (unsigned i = tbf->llc_index; i < tbf->llc_index + llc_pdu_len; i++)
 					{
-						tbf->rlc_data[i] = ul_data_block->RLC_DATA[data_octet_num];
+						tbf->llc_frame[i] = ul_data_block->RLC_DATA[data_octet_num];
 						data_octet_num++;
 					}
-					tbf->data_index += llc_pdu_len;
+					tbf->llc_index += llc_pdu_len;
 					num++;
 				}
 			}
@@ -550,7 +619,7 @@ int gprs_rlcmac_rcv_data_block(bitvec *rlc_block)
 	switch (tbf->state) {
 	case GPRS_RLCMAC_WAIT_DATA_SEQ_START: 
 		if (ul_data_block->BSN == 0) {
-			tbf->data_index = 0;
+			tbf->llc_index = 0;
 			gprs_rlcmac_data_block_parse(tbf, ul_data_block);
 			gprs_rlcmac_tx_ul_ack(tbf->tfi, tbf->tlli, ul_data_block);
 			if (ul_data_block->CV == 0) {
@@ -589,9 +658,10 @@ int gprs_rlcmac_rcv_data_block(bitvec *rlc_block)
 	free(ul_data_block);
 	return 1;
 }
+#endif
 
 /* Received Uplink RLC control block. */
-int gprs_rlcmac_rcv_control_block(bitvec *rlc_block)
+int gprs_rlcmac_rcv_control_block(bitvec *rlc_block, uint32_t fn)
 {
 	uint8_t tfi = 0;
 	uint32_t tlli = 0;
@@ -608,8 +678,17 @@ int gprs_rlcmac_rcv_control_block(bitvec *rlc_block)
 		tlli = ul_control_block->u.Packet_Control_Acknowledgement.TLLI;
 		tbf = tbf_by_tlli(tlli);
 		if (!tbf) {
+			LOGP(DRLCMAC, LOGL_NOTICE, "PACKET CONTROL ACK with "
+				"unknown TLLI=0x%x\n", tlli);
 			return 0;
 		}
+		if (tbf->poll_fn != fn) {
+			LOGP(DRLCMAC, LOGL_NOTICE, "PACKET CONTROL ACK for "
+				"TFI=%d received at FN=%d, but was requested "
+				"for FN=%d\n", tbf->tfi, fn, tbf->poll_fn);
+		} else {
+			LOGP(DRLCMAC, LOGL_NOTICE, "PACKET CONTROL ACK received on FN=%d as expected\n", fn);
+		}
 		LOGP(DRLCMAC, LOGL_NOTICE, "RX: [PCU <- BTS] TFI: %u TLLI: 0x%08x Packet Control Ack\n", tbf->tfi, tbf->tlli);
 		LOGP(DRLCMAC, LOGL_NOTICE, "TBF: [UPLINK] END TFI: %u TLLI: 0x%08x \n", tbf->tfi, tbf->tlli);
 		tbf_free(tbf);
@@ -630,59 +709,43 @@ int gprs_rlcmac_rcv_control_block(bitvec *rlc_block)
 	return 1;
 }
 
-void gprs_rlcmac_rcv_block(bitvec *rlc_block)
+int gprs_rlcmac_rcv_block(uint8_t *data, uint8_t len, uint32_t fn)
 {
-	unsigned readIndex = 0;
-	unsigned payload = bitvec_read_field(rlc_block, readIndex, 2);
+	unsigned payload = data[0] >> 6;
+	bitvec *block;
+	int rc = 0;
 
 	switch (payload) {
 	case GPRS_RLCMAC_DATA_BLOCK:
-		gprs_rlcmac_rcv_data_block(rlc_block);
+		rc = gprs_rlcmac_rcv_data_block_acknowledged(data, len);
 		break;
 	case GPRS_RLCMAC_CONTROL_BLOCK:
-		gprs_rlcmac_rcv_control_block(rlc_block);
+		block = bitvec_alloc(len);
+		if (!block)
+			return -ENOMEM;
+		bitvec_unpack(block, data);
+		rc = gprs_rlcmac_rcv_control_block(block, fn);
+		bitvec_free(block);
 		break;
 	case GPRS_RLCMAC_CONTROL_BLOCK_OPT:
 		LOGP(DRLCMAC, LOGL_NOTICE, "GPRS_RLCMAC_CONTROL_BLOCK_OPT block payload is not supported.\n");
 	default:
 		LOGP(DRLCMAC, LOGL_NOTICE, "Unknown RLCMAC block payload.\n");
+		rc = -EINVAL;
 	}
-}
-
-struct msgb *gen_dummy_msg(uint8_t usf)
-{
-	struct msgb *msg = msgb_alloc(23, "rlcmac_dl_idle");
-	// RLC/MAC filler with USF=1
-	bitvec *filler = bitvec_alloc(23);
-#warning HACK
-	if (usf == 1)
-		bitvec_unhex(filler, "41942b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b");
-	else
-		bitvec_unhex(filler, "42942b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b");
-	bitvec_pack(filler, msgb_put(msg, 23));
-	bitvec_free(filler);
-	return msg;
-}
 
-void gprs_rlcmac_rcv_rts_block(uint8_t trx, uint8_t ts, uint16_t arfcn,
-	uint32_t fn, uint8_t block_nr)
-{
-	struct msgb *msg;
-	
-	set_current_fn(fn);
-	msg = msgb_dequeue(&block_queue);
-	if (!msg)
-		msg = gen_dummy_msg(block_nr ? 2 : 1);
-	pcu_l1if_tx_pdtch(msg, trx, ts, arfcn, fn, block_nr);
+	return rc;
 }
 
+#if 0
 int select_pdch(uint8_t *_trx, uint8_t *_ts)
 {
+	struct gprs_rlcmac_bts *bts = gprs_rlcmac_bts;
 	uint8_t trx, ts;
 
 	for (trx = 0; trx < 8; trx++) {
 		for (ts = 0; ts < 8; ts++) {
-			if (pcu_l1if_bts.trx[trx].ts[ts].enable) {
+			if (bts->trx[trx].pdch[ts].enable) {
 				*_trx = trx;
 				*_ts = ts;
 				return 0;
@@ -692,21 +755,26 @@ int select_pdch(uint8_t *_trx, uint8_t *_ts)
 
 	return -EBUSY;
 }
+#endif
 
 int gprs_rlcmac_rcv_rach(uint8_t ra, uint32_t Fn, int16_t qta)
 {
 	struct gprs_rlcmac_tbf *tbf;
 	uint8_t trx, ts;
+	int tfi, usf; /* must be signed */
 
-	if (select_pdch(&trx, &ts)) {
+	// Create new TBF
+	tfi = tfi_alloc(&trx, &ts);
+	if (tfi < 0) {
 		LOGP(DRLCMAC, LOGL_NOTICE, "No PDCH ressource\n");
 		/* FIXME: send reject */
 		return -EBUSY;
 	}
-	// Create new TBF
-	int tfi = tfi_alloc();
-	if (tfi < 0) {
-		return tfi;
+	usf = find_free_usf(trx, ts);
+	if (usf < 0) {
+		LOGP(DRLCMAC, LOGL_NOTICE, "No PDCH ressource for USF\n");
+		/* FIXME: send reject */
+		return -EBUSY;
 	}
 	tbf = tbf_alloc(tfi, trx, ts);
 	if (qta < 0)
@@ -715,13 +783,15 @@ int gprs_rlcmac_rcv_rach(uint8_t ra, uint32_t Fn, int16_t qta)
 		qta = 252;
 	tbf->ta = qta >> 2;
 	tbf->direction = GPRS_RLCMAC_UL_TBF;
-	tbf->state = GPRS_RLCMAC_WAIT_DATA_SEQ_START;
+	tbf->dir.ul.usf = usf;
+	tbf->state = GPRS_RLCMAC_FLOW;
+	tbf_timer_start(tbf, 3169, T3169);
 	LOGP(DRLCMAC, LOGL_NOTICE, "TBF: [UPLINK] START TFI: %u\n", tbf->tfi);
 	LOGP(DRLCMAC, LOGL_NOTICE, "RX: [PCU <- BTS] TFI: %u RACH qbit-ta=%d ra=%d, Fn=%d (%d,%d,%d)\n", tbf->tfi, qta, ra, Fn, (Fn / (26 * 51)) % 32, Fn % 51, Fn % 26);
 	LOGP(DRLCMAC, LOGL_NOTICE, "TX: [PCU -> BTS] TFI: %u Packet Immidiate Assignment\n", tbf->tfi);
 	bitvec *immediate_assignment = bitvec_alloc(23);
 	bitvec_unhex(immediate_assignment, "2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b");
-	int len = write_immediate_assignment(immediate_assignment, 0, ra, Fn, tbf->ta, tbf->arfcn, tbf->ts, tbf->tsc, tbf->tfi);
+	int len = write_immediate_assignment(immediate_assignment, 0, ra, Fn, tbf->ta, tbf->arfcn, tbf->ts, tbf->tsc, tbf->tfi, usf);
 	pcu_l1if_tx_agch(immediate_assignment, len);
 	bitvec_free(immediate_assignment);
 
@@ -803,10 +873,10 @@ int gprs_rlcmac_segment_llc_pdu(struct gprs_rlcmac_tbf *tbf)
 
 
 	// LLC PDU fits into one RLC data block with optional LI field.
-	if (tbf->data_index < BLOCK_LEN - 4)
+	if (tbf->llc_index < BLOCK_LEN - 4)
 	{
 		fbi = 1;
-		gprs_rlcmac_tx_dl_data_block(tbf->tlli, tbf->tfi, tbf->rlc_data, 0, tbf->data_index, bsn, fbi);
+		gprs_rlcmac_tx_dl_data_block(tbf->tlli, tbf->tfi, tbf->llc_frame, 0, tbf->llc_index, bsn, fbi);
 	}
 	// Necessary several RLC data blocks for transmit LLC PDU.
 	else
@@ -815,10 +885,10 @@ int gprs_rlcmac_segment_llc_pdu(struct gprs_rlcmac_tbf *tbf)
 		int block_data_len = BLOCK_LEN - 3; 
 		
 		// number of blocks with 20 octets length RLC data field
-		num_blocks = tbf->data_index/block_data_len; 
+		num_blocks = tbf->llc_index/block_data_len; 
 		
 		// rest of LLC PDU, which doesn't fit into data blocks with 20 octets RLC data field
-		int rest_len = tbf->data_index%BLOCK_DATA_LEN; 
+		int rest_len = tbf->llc_index%BLOCK_DATA_LEN; 
 		if (rest_len > 0)
 		{
 			// add one block for transmission rest of LLC PDU
@@ -840,7 +910,7 @@ int gprs_rlcmac_segment_llc_pdu(struct gprs_rlcmac_tbf *tbf)
 				fbi = 1;
 			}
 			end_index = start_index + block_data_len;
-			gprs_rlcmac_tx_dl_data_block(tbf->tlli, tbf->tfi, tbf->rlc_data, start_index, end_index, bsn, fbi);
+			gprs_rlcmac_tx_dl_data_block(tbf->tlli, tbf->tfi, tbf->llc_frame, start_index, end_index, bsn, fbi);
 			start_index += block_data_len;
 		}
 	}
@@ -853,12 +923,12 @@ void gprs_rlcmac_tx_ul_ud(gprs_rlcmac_tbf *tbf)
 {
 	const uint8_t qos_profile = QOS_PROFILE;
 	struct msgb *llc_pdu;
-	unsigned msg_len = NS_HDR_LEN + BSSGP_HDR_LEN + tbf->data_index;
+	unsigned msg_len = NS_HDR_LEN + BSSGP_HDR_LEN + tbf->llc_index;
 
-	LOGP(DBSSGP, LOGL_NOTICE, "TX: [PCU -> SGSN ] TFI: %u TLLI: 0x%08x DataLen: %u", tbf->tfi, tbf->tlli, tbf->data_index);
+	LOGP(DBSSGP, LOGL_NOTICE, "TX: [PCU -> SGSN ] TFI: %u TLLI: 0x%08x DataLen: %u", tbf->tfi, tbf->tlli, tbf->llc_index);
 	//LOGP(DBSSGP, LOGL_NOTICE, " Data = ");
-	//for (unsigned i = 0; i < tbf->data_index; i++)
-	//	LOGPC(DBSSGP, LOGL_NOTICE, "%02x ", tbf->rlc_data[i]);
+	//for (unsigned i = 0; i < tbf->llc_index; i++)
+	//	LOGPC(DBSSGP, LOGL_NOTICE, "%02x ", tbf->llc_frame[i]);
 	
 	bctx->cell_id = CELL_ID;
 	bctx->nsei = NSEI;
@@ -869,7 +939,7 @@ void gprs_rlcmac_tx_ul_ud(gprs_rlcmac_tbf *tbf)
 	bctx->bvci = BVCI;
 
 	llc_pdu = msgb_alloc_headroom(msg_len, msg_len,"llc_pdu");
-	msgb_tvlv_push(llc_pdu, BSSGP_IE_LLC_PDU, sizeof(uint8_t)*tbf->data_index, tbf->rlc_data);
+	msgb_tvlv_push(llc_pdu, BSSGP_IE_LLC_PDU, sizeof(uint8_t)*tbf->llc_index, tbf->llc_frame);
 	bssgp_tx_ul_ud(bctx, tbf->tlli, &qos_profile, llc_pdu);
 }
 
@@ -878,7 +948,7 @@ void gprs_rlcmac_downlink_assignment(gprs_rlcmac_tbf *tbf)
 	LOGP(DRLCMAC, LOGL_NOTICE, "TX: [PCU -> BTS] TFI: %u TLLI: 0x%08x Immidiate Assignment (CCCH)\n", tbf->tfi, tbf->tlli);
 	bitvec *immediate_assignment = bitvec_alloc(23);
 	bitvec_unhex(immediate_assignment, "2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b");
-	int len = write_immediate_assignment(immediate_assignment, 1, 125, get_current_fn(), tbf->ta, tbf->arfcn, tbf->ts, tbf->tsc, tbf->tfi, tbf->tlli);
+	int len = write_immediate_assignment(immediate_assignment, 1, 125, get_current_fn(), tbf->ta, tbf->arfcn, tbf->ts, tbf->tsc, tbf->tfi, 0, tbf->tlli);
 	pcu_l1if_tx_agch(immediate_assignment, len);
 	bitvec_free(immediate_assignment);
 	tbf_gsm_timer_start(tbf, 0, 120);
@@ -889,7 +959,6 @@ void gprs_rlcmac_packet_downlink_assignment(gprs_rlcmac_tbf *tbf)
 	LOGP(DRLCMAC, LOGL_NOTICE, "TX: [PCU -> BTS] TFI: %u TLLI: 0x%08x Packet DL Assignment\n", tbf->tfi, tbf->tlli);
 	bitvec *packet_downlink_assignment_vec = bitvec_alloc(23);
 	bitvec_unhex(packet_downlink_assignment_vec, "2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b");
-	printf("tbf->ts %d\n", tbf->ts);
 	write_packet_downlink_assignment(packet_downlink_assignment_vec, tbf->tfi, tbf->tlli, tbf->arfcn, tbf->ts, tbf->ta, tbf->tsc);
 	RlcMacDownlink_t * packet_downlink_assignment = (RlcMacDownlink_t *)malloc(sizeof(RlcMacDownlink_t));
 	LOGP(DRLCMAC, LOGL_NOTICE, "+++++++++++++++++++++++++ TX : Packet Downlink Assignment +++++++++++++++++++++++++\n");
diff --git a/src/gprs_rlcmac.h b/src/gprs_rlcmac.h
index 83ef7bd9..50d2e84c 100644
--- a/src/gprs_rlcmac.h
+++ b/src/gprs_rlcmac.h
@@ -29,13 +29,60 @@ extern "C" {
 #include <osmocom/core/timer.h>
 }
 
+/*
+ * PDCH instanc
+ */
+
+struct gprs_rlcmac_tbf;
+
+struct gprs_rlcmac_pdch {
+	uint8_t enable; /* TS is enabled */
+	uint8_t tsc; /* TSC of this slot */
+	uint8_t next_ul_tfi; /* next uplink TBF/TFI to schedule (0..31) */
+	uint8_t next_dl_tfi; /* next downlink TBF/TFI to schedule (0..31) */
+	struct gprs_rlcmac_tbf *tbf[32]; /* array of TBF pointers, by TFI */
+};
+
+struct gprs_rlcmac_trx {
+	uint16_t arfcn;
+	struct gprs_rlcmac_pdch pdch[8];
+};
+
+struct gprs_rlcmac_bts {
+	struct gprs_rlcmac_trx trx[8];
+};
+
+extern struct gprs_rlcmac_bts *gprs_rlcmac_bts;
+
+/*
+ * TBF instance
+ */
+
 #define LLC_MAX_LEN 1543
+#define RLC_MAX_SNS 128 /* GPRS, must be power of 2 */
+#define RLC_MAX_WS  64 /* max window size */
+#define RLC_MAX_LEN 52 /* CS-4 */
 #define UL_RLC_DATA_BLOCK_LEN 23
 
+#define T3169 6		/* 5 seconds + one second, because we don't use
+			 * counters before starting timer. */
+#define N3103_MAX 4	/* how many tries to poll PACKET CONTROL ACK */
+
 enum gprs_rlcmac_tbf_state {
-	GPRS_RLCMAC_WAIT_DATA_SEQ_START,
-	GPRS_RLCMAC_WAIT_NEXT_DATA_BLOCK,
-	GPRS_RLCMAC_WAIT_NEXT_DATA_SEQ
+	GPRS_RLCMAC_FLOW,	/* RLC/MAC flow, ressource needed */
+	GPRS_RLCMAC_FINISHED,	/* flow finished, wait for release */
+	GPRS_RLCMAC_RELEASING,	/* releasing, wait to free TBI/USF */
+};
+
+enum gprs_rlcmac_tbf_poll_state {
+	GPRS_RLCMAC_POLL_NONE = 0,
+	GPRS_RLCMAC_POLL_SCHED, /* a polling was scheduled */
+};
+
+enum gprs_rlcmac_tbf_ul_substate {
+	GPRS_RLCMAC_UL_NONE = 0,
+	GPRS_RLCMAC_UL_SEND_ACK, /* send acknowledge on next RTS */
+	GPRS_RLCMAC_UL_WAIT_POLL, /* wait for PACKET CONTROL ACK */
 };
 
 enum gprs_rlcmac_tbf_direction {
@@ -49,11 +96,36 @@ struct gprs_rlcmac_tbf {
 	enum gprs_rlcmac_tbf_direction direction;
 	uint8_t tfi;
 	uint32_t tlli;
-	uint8_t rlc_data[LLC_MAX_LEN];
-	uint16_t data_index;
-	uint8_t bsn;
+	uint8_t tlli_valid;
 	uint8_t trx, ts, tsc;
 	uint16_t arfcn, ta;
+	uint8_t llc_frame[LLC_MAX_LEN];
+	uint16_t llc_index;
+
+	enum gprs_rlcmac_tbf_poll_state poll_state;
+	uint32_t poll_fn;
+
+	uint16_t bsn;	/* block sequence number */
+	uint16_t ws;	/* window size */
+	uint16_t sns;	/* sequence number space */
+	union {
+		struct {
+			uint16_t v_s;	/* send state */
+			uint16_t v_a;	/* ack state */
+			char v_b[RLC_MAX_SNS/2]; /* acknowledge state array */
+		} dl;
+		struct {
+			uint16_t v_r;	/* receive state */
+			uint16_t v_q;	/* receive window state */
+			char v_n[RLC_MAX_SNS/2]; /* receive state array */
+			int32_t rx_counter; /* count all received blocks */
+			enum gprs_rlcmac_tbf_ul_substate substate;
+			uint8_t usf;	/* USF */
+			uint8_t n3103;	/* N3103 counter */
+		} ul;
+	} dir;
+	uint8_t rlc_block[RLC_MAX_SNS/2][RLC_MAX_LEN]; /* block history */
+	uint8_t rlc_block_len[RLC_MAX_SNS/2]; /* block len  of history */
 	
 	struct osmo_timer_list	timer;
 	unsigned int T; /* Txxxx number */
@@ -66,9 +138,7 @@ struct gprs_rlcmac_tbf {
 
 extern struct llist_head gprs_rlcmac_tbfs;
 
-int select_pdch(uint8_t *_trx, uint8_t *_ts);
-
-int tfi_alloc();
+int tfi_alloc(uint8_t *_trx, uint8_t *_ts);
 
 struct gprs_rlcmac_tbf *tbf_alloc(uint8_t tfi, uint8_t trx, uint8_t ts);
 
@@ -78,6 +148,11 @@ struct gprs_rlcmac_tbf *tbf_by_tlli(uint8_t tlli);
 
 void tbf_free(struct gprs_rlcmac_tbf *tbf);
 
+void tbf_timer_start(struct gprs_rlcmac_tbf *tbf, unsigned int T,
+                                unsigned int seconds);
+
+void tbf_timer_stop(struct gprs_rlcmac_tbf *tbf);
+
 /* TS 44.060 Section 10.4.7 Table 10.4.7.1: Payload Type field */
 enum gprs_rlcmac_block_type {
 	GPRS_RLCMAC_DATA_BLOCK = 0x0,
@@ -94,9 +169,9 @@ int gprs_rlcmac_rcv_data_block(bitvec *rlc_block);
 
 int gprs_rlcmac_rcv_control_block(bitvec *rlc_block);
 
-void gprs_rlcmac_rcv_block(bitvec *rlc_block);
+int gprs_rlcmac_rcv_block(uint8_t *data, uint8_t len, uint32_t fn);
 
-void gprs_rlcmac_rcv_rts_block(uint8_t trx, uint8_t ts, uint16_t arfcn, 
+int gprs_rlcmac_rcv_rts_block(uint8_t trx, uint8_t ts, uint16_t arfcn, 
         uint32_t fn, uint8_t block_nr);
 
 int gprs_rlcmac_rcv_rach(uint8_t ra, uint32_t Fn, int16_t qta);
@@ -111,5 +186,11 @@ void gprs_rlcmac_downlink_assignment(gprs_rlcmac_tbf *tbf);
 
 void gprs_rlcmac_packet_downlink_assignment(gprs_rlcmac_tbf *tbf);
 
+void gprs_rlcmac_enqueue_block(bitvec *block, int len);
+
+int gprs_rlcmac_rcv_data_block_acknowledged(uint8_t *data, uint8_t len);
+
+struct msgb *gprs_rlcmac_send_uplink_ack(struct gprs_rlcmac_tbf *tbf,
+        uint32_t fn);
 
 #endif // GPRS_RLCMAC_H
diff --git a/src/pcu_l1_if.cpp b/src/pcu_l1_if.cpp
index 4836e940..c73a789c 100644
--- a/src/pcu_l1_if.cpp
+++ b/src/pcu_l1_if.cpp
@@ -73,8 +73,6 @@ struct l1fwd_hdl {
 
 struct l1fwd_hdl *l1fh = talloc_zero(NULL, struct l1fwd_hdl);
 
-struct pcu_l1if_bts pcu_l1if_bts;
-
 // Variable for storage current FN.
 int frame_number;
 
@@ -127,19 +125,19 @@ void pcu_l1if_tx_agch(bitvec * block, int len)
 
 int pcu_l1if_rx_pdch(GsmL1_PhDataInd_t *data_ind)
 {
-	bitvec *block = bitvec_alloc(data_ind->msgUnitParam.u8Size);
-	bitvec_unpack(block, data_ind->msgUnitParam.u8Buffer);
-	gprs_rlcmac_rcv_block(block);
-	bitvec_free(block);
+	gprs_rlcmac_rcv_block(data_ind->msgUnitParam.u8Buffer,
+		data_ind->msgUnitParam.u8Size, data_ind->u32Fn);
 
 	return 0;
 }
 
 static int handle_ph_connect_ind(struct femtol1_hdl *fl1, GsmL1_PhConnectInd_t *connect_ind)
 {
-	pcu_l1if_bts.trx[0].arfcn = connect_ind->u16Arfcn;
-	pcu_l1if_bts.trx[0].ts[connect_ind->u8Tn].enable = 1;
-	pcu_l1if_bts.trx[0].ts[connect_ind->u8Tn].tsc = connect_ind->u8Tsc;
+	struct gprs_rlcmac_bts *bts = gprs_rlcmac_bts;
+
+	bts->trx[0].arfcn = connect_ind->u16Arfcn;
+	bts->trx[0].pdch[connect_ind->u8Tn].enable = 1;
+	bts->trx[0].pdch[connect_ind->u8Tn].tsc = connect_ind->u8Tsc;
 	(l1fh->fl1h)->channel_info.arfcn = connect_ind->u16Arfcn;
 	(l1fh->fl1h)->channel_info.tn = connect_ind->u8Tn;
 	(l1fh->fl1h)->channel_info.tsc = connect_ind->u8Tsc;
@@ -283,8 +281,6 @@ int pcu_l1if_open()
 	struct femtol1_hdl *fl1h;
 	int rc;
 
-	memset(&pcu_l1if_bts, 0, sizeof(pcu_l1if_bts));
-
 	/* allocate new femtol1_handle */
 	fl1h = talloc_zero(NULL, struct femtol1_hdl);
 	INIT_LLIST_HEAD(&fl1h->wlc_list);
diff --git a/src/pcu_l1_if.h b/src/pcu_l1_if.h
index 241f4943..5d40cd1d 100644
--- a/src/pcu_l1_if.h
+++ b/src/pcu_l1_if.h
@@ -29,22 +29,6 @@ extern "C" {
 #include <osmocom/gsm/gsm_utils.h>
 }
 
-struct pcu_l1if_ts {
-	uint8_t enable;
-	uint8_t tsc;
-};
-
-struct pcu_l1if_trx {
-	uint16_t arfcn;
-	struct pcu_l1if_ts ts[8];
-};
-
-struct pcu_l1if_bts {
-	struct pcu_l1if_trx trx[8];
-};
-
-extern struct pcu_l1if_bts pcu_l1if_bts;
-
 int get_current_fn();
 void set_current_fn(int fn);
 
diff --git a/src/pcu_main.cpp b/src/pcu_main.cpp
index 329f669f..ece78f1a 100644
--- a/src/pcu_main.cpp
+++ b/src/pcu_main.cpp
@@ -20,9 +20,12 @@
 #include <gprs_bssgp_pcu.h>
 #include <arpa/inet.h>
 #include <pcu_l1_if.h>
+#include <gprs_rlcmac.h>
 #include <gsm_timer.h>
 #include <gprs_debug.h>
 
+struct gprs_rlcmac_bts *gprs_rlcmac_bts;
+
 // TODO: We should move this parameters to config file.
 #define SGSN_IP "127.0.0.1"
 #define SGSN_PORT 23000
@@ -51,6 +54,11 @@ int main(int argc, char *argv[])
 	uint16_t nsvci = NSVCI;
 	struct gprs_ns_inst *sgsn_nsi;
 	struct gprs_nsvc *nsvc;
+
+	gprs_rlcmac_bts = talloc_zero(NULL, struct gprs_rlcmac_bts);
+	if (!gprs_rlcmac_bts)
+		return -ENOMEM;
+
 	osmo_init_logging(&gprs_log_info);
 	pcu_l1if_open();
 
@@ -93,5 +101,7 @@ int main(int argc, char *argv[])
 		}
 		i++;
 	}
+
+	talloc_free(gprs_rlcmac_bts);
 }
 
diff --git a/src/sysmo_l1_if.cpp b/src/sysmo_l1_if.cpp
index 09a31495..a83f0f81 100644
--- a/src/sysmo_l1_if.cpp
+++ b/src/sysmo_l1_if.cpp
@@ -39,8 +39,6 @@ extern "C" {
 static int pcu_sock_send(struct msgb *msg);
 static void pcu_sock_timeout(void *_priv);
 
-struct pcu_l1if_bts pcu_l1if_bts;
-
 // Variable for storage current FN.
 int frame_number;
 
@@ -159,7 +157,6 @@ static void pcu_l1if_tx_bcch(uint8_t *data, int len)
 static int pcu_rx_data_ind(struct gsm_pcu_if_data *data_ind)
 {
 	int rc = 0;
-	bitvec *block;
 
 	LOGP(DL1IF, LOGL_DEBUG, "Data indication received: sapi=%d arfcn=%d "
 		"block=%d data=%s\n", data_ind->sapi,
@@ -168,14 +165,8 @@ static int pcu_rx_data_ind(struct gsm_pcu_if_data *data_ind)
 
 	switch (data_ind->sapi) {
 	case PCU_IF_SAPI_PDTCH:
-		block = bitvec_alloc(data_ind->len);
-		if (!block) {
-			rc = -ENOMEM;
-			break;
-		}
-		bitvec_unpack(block, data_ind->data);
-		gprs_rlcmac_rcv_block(block);
-		bitvec_free(block);
+		rc = gprs_rlcmac_rcv_block(data_ind->data, data_ind->len,
+			data_ind->fn);
 		break;
 	default:
 		LOGP(DL1IF, LOGL_ERROR, "Received PCU data indication with "
@@ -241,8 +232,10 @@ static int pcu_rx_rach_ind(struct gsm_pcu_if_rach_ind *rach_ind)
 
 static int pcu_rx_info_ind(struct gsm_pcu_if_info_ind *info_ind)
 {
+	struct gprs_rlcmac_bts *bts = gprs_rlcmac_bts;
 	int rc = 0;
-	int trx, ts;
+	int trx, ts, tfi;
+	struct gprs_rlcmac_tbf *tbf;
 //	uint8_t si13[23];
 
 	LOGP(DL1IF, LOGL_INFO, "Info indication received:\n");
@@ -254,21 +247,27 @@ static int pcu_rx_info_ind(struct gsm_pcu_if_info_ind *info_ind)
 	LOGP(DL1IF, LOGL_INFO, "BTS available\n");
 
 	for (trx = 0; trx < 8; trx++) {
-		pcu_l1if_bts.trx[trx].arfcn = info_ind->trx[trx].arfcn;
+		bts->trx[trx].arfcn = info_ind->trx[trx].arfcn;
 		for (ts = 0; ts < 8; ts++) {
 			if ((info_ind->trx[trx].pdch_mask & (1 << ts))) {
 				/* FIXME: activate dynamically at RLCMAC */
-				if (!pcu_l1if_bts.trx[trx].ts[ts].enable)
+				if (!bts->trx[trx].pdch[ts].enable)
 					pcu_tx_act_req(trx, ts, 1);
-				pcu_l1if_bts.trx[trx].ts[ts].enable = 1;
-				pcu_l1if_bts.trx[trx].ts[ts].tsc =
+				bts->trx[trx].pdch[ts].enable = 1;
+				bts->trx[trx].pdch[ts].tsc =
 					info_ind->trx[trx].tsc[ts];
 				LOGP(DL1IF, LOGL_INFO, "PDCH: trx=%d ts=%d\n",
 					trx, ts);
 			} else {
-				if (pcu_l1if_bts.trx[trx].ts[ts].enable)
+				if (bts->trx[trx].pdch[ts].enable)
 					pcu_tx_act_req(trx, ts, 0);
-				pcu_l1if_bts.trx[trx].ts[ts].enable = 0;
+				bts->trx[trx].pdch[ts].enable = 0;
+				/* kick all tbf  FIXME: multislot  */
+				for (tfi = 0; tfi < 32; tfi++) {
+					tbf = bts->trx[trx].pdch[ts].tbf[tfi];
+					if (tbf)
+						tbf_free(tbf);
+				}
 			}
 		}
 	}
@@ -342,6 +341,9 @@ static int pcu_sock_send(struct msgb *msg)
 static void pcu_sock_close(struct pcu_sock_state *state)
 {
 	struct osmo_fd *bfd = &state->conn_bfd;
+	struct gprs_rlcmac_bts *bts = gprs_rlcmac_bts;
+	struct gprs_rlcmac_tbf *tbf;
+	uint8_t trx, ts, tfi;
 
 	LOGP(DL1IF, LOGL_NOTICE, "PCU socket has LOST connection\n");
 
@@ -355,8 +357,17 @@ static void pcu_sock_close(struct pcu_sock_state *state)
 		msgb_free(msg);
 	}
 
-	/* disable all slots */
-	memset(&pcu_l1if_bts, 0, sizeof(pcu_l1if_bts));
+	/* disable all slots, kick all TBFs */
+	for (trx = 0; trx < 8; trx++) {
+		for (ts = 0; ts < 8; ts++) {
+			bts->trx[trx].pdch[ts].enable = 0;
+			for (tfi = 0; tfi < 32; tfi++) {
+				tbf = bts->trx[trx].pdch[ts].tbf[tfi];
+				if (tbf)
+					tbf_free(tbf);
+			}
+		}
+	}
 
 	state->timer.cb = pcu_sock_timeout;
 	osmo_timer_schedule(&state->timer, 5, 0);
@@ -470,8 +481,6 @@ int pcu_l1if_open(void)
 	unsigned int namelen;
 	int rc;
 
-	memset(&pcu_l1if_bts, 0, sizeof(pcu_l1if_bts));
-
 	state = pcu_sock_state;
 	if (!state) {
 		state = talloc_zero(NULL, struct pcu_sock_state);