Merge branch 'jolly'

Merged jolly branch with master, fixed conflicts.

9 files changed, 914 insertions, 209 deletions

diff --git a/src/Makefile.am b/src/Makefile.am
index 196e3c22..b7b9885a 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -18,8 +18,12 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 
-AM_CPPFLAGS = $(STD_DEFINES_AND_INCLUDES)
-AM_CXXFLAGS = -Wall -ldl -pthread
+# FIXME: This has to go!!
+OPENBSC_DIR = $(top_srcdir)/../openbsc/openbsc
+OPENGGSN_DIR = $(top_srcdir)/../openggsn
+
+AM_CPPFLAGS = $(STD_DEFINES_AND_INCLUDES) -I$(OPENBSC_DIR)/include
+AM_CXXFLAGS = -Wall -ldl -pthread -lgtp
 
 noinst_LTLIBRARIES = libgprs.la
 
@@ -29,10 +33,17 @@ libgprs_la_SOURCES = \
 	gsm_rlcmac.cpp \
 	gprs_bssgp_pcu.cpp \
 	gprs_rlcmac.cpp \
-	pcu_l1_if.cpp \
 	gsm_timer.cpp \
 	bitvector.cpp
 
+if ENABLE_SYSMOBTS
+libgprs_la_SOURCES += \
+	sysmo_l1_if.cpp
+else
+libgprs_la_SOURCES += \
+	pcu_l1_if.cpp
+endif
+
 noinst_PROGRAMS = \
 	RLCMACTest \
 	pcu
diff --git a/src/gprs_bssgp_pcu.cpp b/src/gprs_bssgp_pcu.cpp
index 90564cad..c5360bc7 100644
--- a/src/gprs_bssgp_pcu.cpp
+++ b/src/gprs_bssgp_pcu.cpp
@@ -29,10 +29,12 @@ int gprs_bssgp_pcu_rx_dl_ud(struct msgb *msg, struct tlv_parsed *tp)
 {
 	struct bssgp_ud_hdr *budh;
 	int i = 0;
+	uint8_t trx, ts;
 
 	budh = (struct bssgp_ud_hdr *)msgb_bssgph(msg);
 	
 	struct gprs_rlcmac_tbf *tbf;
+
 	tbf = tbf_alloc(GPRS_RLCMAC_DL_TBF, ntohl(budh->tlli));
 
 	if (!tbf)
diff --git a/src/gprs_bssgp_pcu.h b/src/gprs_bssgp_pcu.h
index d6ffa81a..bf1e3127 100644
--- a/src/gprs_bssgp_pcu.h
+++ b/src/gprs_bssgp_pcu.h
@@ -50,11 +50,11 @@ struct bssgp_bvc_ctx *btsctx_alloc(uint16_t bvci, uint16_t nsei);
 #define BLOCK_DATA_LEN 20
 #define BLOCK_LEN 23
 
-#define CELL_ID 3
-#define MNC 55
-#define MCC 905
-#define PCU_LAC 1000
-#define PCU_RAC 1
+#define CELL_ID 0
+#define MNC 1
+#define MCC 001
+#define PCU_LAC 1
+#define PCU_RAC 0
 
 
 extern struct bssgp_bvc_ctx *bctx;
diff --git a/src/gprs_rlcmac.cpp b/src/gprs_rlcmac.cpp
index f20fd2f3..f482653e 100644
--- a/src/gprs_rlcmac.cpp
+++ b/src/gprs_rlcmac.cpp
@@ -24,6 +24,7 @@
 
 LLIST_HEAD(gprs_rlcmac_tbfs);
 void *rlcmac_tall_ctx;
+LLIST_HEAD(block_queue);
 
 int tfi_alloc()
 {
@@ -104,7 +105,7 @@ int tbf_add_llc_pdu(struct gprs_rlcmac_tbf *tbf, uint8_t *data, uint16_t llc_pdu
 		llc_pdu->data[i] = data[i];
 		LOGPC(DBSSGP, LOGL_NOTICE, "%02x", llc_pdu->data[i]);
 	}
-	LOGP(DBSSGP, LOGL_NOTICE, "\n");
+	LOGPC(DBSSGP, LOGL_NOTICE, "\n");
 
 	llist_add(&llc_pdu->list, &tbf->llc_pdus);
 	tbf->llc_pdu_list_len++;
@@ -116,6 +117,7 @@ struct gprs_rlcmac_tbf *tbf_alloc(gprs_rlcmac_tbf_direction dir, uint32_t tlli)
 	struct gprs_rlcmac_tbf *exist_tbf;
 	struct gprs_rlcmac_tbf *tbf;
 	uint8_t tfi;
+	uint8_t trx, ts;
 
 	// Downlink TDF allocation
 	if (dir == GPRS_RLCMAC_DL_TBF)
@@ -151,7 +153,19 @@ struct gprs_rlcmac_tbf *tbf_alloc(gprs_rlcmac_tbf_direction dir, uint32_t tlli)
 					if (tfi < 0) {
 						return NULL;
 					}
+					
+					/* FIXME: select right TRX/TS */
+					if (select_pdch(&trx, &ts)) {
+						LOGP(DRLCMAC, LOGL_NOTICE, "No PDCH ressource\n");
+						/* FIXME: send reject */
+						return NULL;
+					}
+				
 					tbf->tfi = tfi;
+					tbf->trx = trx;
+					tbf->ts = ts;
+					tbf->arfcn = pcu_l1if_bts.trx[trx].arfcn;
+					tbf->tsc = pcu_l1if_bts.trx[trx].ts[ts].tsc;
 					tbf->llc_pdus = LLIST_HEAD_INIT(tbf->llc_pdus);
 					tbf->llc_pdu_list_len = 0;
 					tbf->direction = GPRS_RLCMAC_DL_TBF;
@@ -180,7 +194,19 @@ struct gprs_rlcmac_tbf *tbf_alloc(gprs_rlcmac_tbf_direction dir, uint32_t tlli)
 				if (tfi < 0) {
 					return NULL;
 				}
+				
+				/* FIXME: select right TRX/TS */
+				if (select_pdch(&trx, &ts)) {
+					LOGP(DRLCMAC, LOGL_NOTICE, "No PDCH ressource\n");
+					/* FIXME: send reject */
+					return NULL;
+				}
+				
 				tbf->tfi = tfi;
+				tbf->trx = trx;
+				tbf->ts = ts;
+				tbf->arfcn = pcu_l1if_bts.trx[trx].arfcn;
+				tbf->tsc = pcu_l1if_bts.trx[trx].ts[ts].tsc;
 				tbf->llc_pdus = LLIST_HEAD_INIT(tbf->llc_pdus);
 				tbf->llc_pdu_list_len = 0;
 				tbf->direction = GPRS_RLCMAC_DL_TBF;
@@ -207,7 +233,16 @@ struct gprs_rlcmac_tbf *tbf_alloc(gprs_rlcmac_tbf_direction dir, uint32_t tlli)
 			if (tfi < 0) {
 				return NULL;
 			}
+			if (select_pdch(&trx, &ts)) {
+				LOGP(DRLCMAC, LOGL_NOTICE, "No PDCH ressource\n");
+				/* FIXME: send reject */
+				return NULL;
+			}
 			tbf->tfi = tfi;
+			tbf->trx = trx;
+			tbf->ts = ts;
+			tbf->arfcn = pcu_l1if_bts.trx[trx].arfcn;
+			tbf->tsc = pcu_l1if_bts.trx[trx].ts[ts].tsc;
 			tbf->llc_pdus = LLIST_HEAD_INIT(tbf->llc_pdus);
 			tbf->llc_pdu_list_len = 0;
 			tbf->direction = GPRS_RLCMAC_UL_TBF;
@@ -225,7 +260,7 @@ struct gprs_rlcmac_tbf *tbf_alloc(gprs_rlcmac_tbf_direction dir, uint32_t tlli)
 }
 
 /* Management of uplink TBF establishment. */
-int tbf_ul_establish(struct gprs_rlcmac_tbf *tbf, uint8_t ra, uint32_t Fn, uint16_t ta)
+int tbf_ul_establish(struct gprs_rlcmac_tbf *tbf, uint8_t ra, uint32_t Fn, uint16_t qta)
 {
 	if (tbf->direction != GPRS_RLCMAC_UL_TBF)
 	{
@@ -237,13 +272,19 @@ int tbf_ul_establish(struct gprs_rlcmac_tbf *tbf, uint8_t ra, uint32_t Fn, uint1
 		switch (tbf->state) {
 		case WAIT_ESTABLISH:
 			{
+				if (qta < 0)
+					qta = 0;
+				if (qta > 252)
+					qta = 252;
+				tbf->ta = qta >> 2;
 				LOGP(DRLCMAC, LOGL_NOTICE, "TBF: [UPLINK] START TFI: %u\n", tbf->tfi);
-				LOGP(DRLCMAC, LOGL_NOTICE, "RX: [PCU <- BTS] TFI: %u RACH\n", tbf->tfi);
+				LOGP(DRLCMAC, LOGL_NOTICE, "RX: [PCU <- BTS] TFI: %u RACH qbit-ta=%d ra=%d, Fn=%d (%d,%d,%d)\n",
+                                                  tbf->tfi, qta, ra, Fn, (Fn / (26 * 51)) % 32, Fn % 51, Fn % 26);
 				LOGP(DRLCMAC, LOGL_NOTICE, "TX: [PCU -> BTS] TFI: %u Packet Immidiate Assignment\n", tbf->tfi);
 				bitvec *immediate_assignment = bitvec_alloc(23);
 				bitvec_unhex(immediate_assignment, "2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b");
-				int len = write_immediate_assignment(immediate_assignment, 0, ra, Fn, ta, tbf->tfi);
-				pcu_l1if_tx(immediate_assignment, GsmL1_Sapi_Agch, len);
+				int len = write_immediate_assignment(immediate_assignment, 0, ra, Fn, tbf->ta, tbf->arfcn, tbf->ts, tbf->tsc, tbf->tfi);
+				pcu_l1if_tx_agch(immediate_assignment, len);
 				bitvec_free(immediate_assignment);
 				tbf->state = FINISH_ESTABLISH;
 			}
@@ -258,7 +299,6 @@ int tbf_ul_establish(struct gprs_rlcmac_tbf *tbf, uint8_t ra, uint32_t Fn, uint1
 	{
 		return -1;
 	}
-
 	return 1;
 }
 
@@ -275,14 +315,14 @@ int tbf_dl_establish(struct gprs_rlcmac_tbf *tbf, uint8_t *imsi)
 		switch (tbf->state) {
 		case WAIT_ESTABLISH:
 			// Wait while UL TBF establishes DL TBF.
-			LOGP(DRLCMAC, LOGL_NOTICE, "TBF: [DOWNLINK] TFI: Wait DL TBF establishment by UL TBF", tbf->tfi);
+			LOGP(DRLCMAC, LOGL_NOTICE, "TBF: [DOWNLINK] TFI: Wait DL TBF establishment by UL TBF\n", tbf->tfi);
 			break;
 		case CCCH_ESTABLISH:
 			if (imsi)
 			{
 				// Downlink TBF Establishment on CCCH ( Paging procedure )
 				// TODO: Implement paging procedure on CCCH.
-				LOGP(DRLCMAC, LOGL_NOTICE, "TBF: [DOWNLINK] TFI: Paging procedure on CCCH : Not implemented yet", tbf->tfi);
+				LOGP(DRLCMAC, LOGL_NOTICE, "TBF: [DOWNLINK] TFI: Paging procedure on CCCH : Not implemented yet\n", tbf->tfi);
 			}
 			else
 			{
@@ -349,9 +389,10 @@ int tbf_ul_data_transfer(struct gprs_rlcmac_tbf *tbf, RlcMacUplinkDataBlock_t *
 		if (tbf->bsn == (ul_data_block->BSN - 1))
 		{
 			gprs_rlcmac_data_block_parse(tbf, ul_data_block);
-			gprs_rlcmac_tx_ul_ack(tbf->tfi, tbf->tlli, ul_data_block);
+			
 			if (ul_data_block->CV == 0)
 			{
+				gprs_rlcmac_tx_ul_ack(tbf->tfi, tbf->tlli, ul_data_block);
 				// Recieved last Data Block in this sequence.
 				tbf->state = FINISH_DATA_TRANSFER;
 				gprs_rlcmac_tx_ul_ud(tbf);
@@ -519,10 +560,18 @@ static void tbf_gsm_timer_start(struct gprs_rlcmac_tbf *tbf, unsigned int fT,
 	osmo_gsm_timer_schedule(&tbf->gsm_timer, frames);
 }
 
-void  write_packet_downlink_assignment(bitvec * dest, uint8_t tfi, uint32_t tlli, uint8_t tn, uint8_t ta, uint8_t tsc)
+static void gprs_rlcmac_enqueue_block(bitvec *block, int len)
+{
+	struct msgb *msg = msgb_alloc(len, "rlcmac_dl");
+	bitvec_pack(block, msgb_put(msg, len));
+	msgb_enqueue(&block_queue, msg);
+}
+
+void  write_packet_downlink_assignment(bitvec * dest, uint8_t tfi, uint32_t tlli, uint16_t arfcn, uint8_t tn, uint8_t ta, uint8_t tsc)
 {
 	// TODO We should use our implementation of encode RLC/MAC Control messages.
 	unsigned wp = 0;
+	int i;
 	bitvec_write_field(dest, wp,0x1,2);  // Payload Type
 	bitvec_write_field(dest, wp,0x0,2);  // Uplink block with TDMA framenumber
 	bitvec_write_field(dest, wp,0x1,1);  // Suppl/Polling Bit
@@ -540,7 +589,7 @@ void  write_packet_downlink_assignment(bitvec * dest, uint8_t tfi, uint32_t tlli
 	bitvec_write_field(dest, wp,0x0,1); // RLC acknowledged mode
 
 	bitvec_write_field(dest, wp,0x0,1); // the network establishes no new downlink TBF for the mobile station
-	bitvec_write_field(dest, wp,0x1,8); // timeslot 7
+	bitvec_write_field(dest, wp,0x80 >> tn,8); // timeslot(s)
 
 	bitvec_write_field(dest, wp,0x1,1); // switch TIMING_ADVANCE_VALUE = on
 	bitvec_write_field(dest, wp,ta,6); // TIMING_ADVANCE_VALUE
@@ -551,22 +600,16 @@ void  write_packet_downlink_assignment(bitvec * dest, uint8_t tfi, uint32_t tlli
 
 	bitvec_write_field(dest, wp,tsc,3); // Training Sequence Code (TSC) = 2
 	bitvec_write_field(dest, wp,0x0,2); // ARFCN = present
-	bitvec_write_field(dest, wp,599,10); // ARFCN
+	bitvec_write_field(dest, wp,arfcn,10); // ARFCN
 
 	bitvec_write_field(dest, wp,0x1,1); // switch TFI   : on
 	bitvec_write_field(dest, wp,tfi,5);// TFI
 
 	bitvec_write_field(dest, wp,0x1,1); // Power Control Parameters IE = present
 	bitvec_write_field(dest, wp,0x0,4); // ALPHA power control parameter
-	bitvec_write_field(dest, wp,0x0,1); // switch GAMMA_TN0 = off
-	bitvec_write_field(dest, wp,0x0,1); // switch GAMMA_TN1 = off
-	bitvec_write_field(dest, wp,0x0,1); // switch GAMMA_TN2 = off
-	bitvec_write_field(dest, wp,0x0,1); // switch GAMMA_TN3 = off
-	bitvec_write_field(dest, wp,0x0,1); // switch GAMMA_TN4 = off
-	bitvec_write_field(dest, wp,0x0,1); // switch GAMMA_TN5 = off
-	bitvec_write_field(dest, wp,0x0,1); // switch GAMMA_TN6 = off
-	bitvec_write_field(dest, wp,0x1,1); // switch GAMMA_TN7 = on
-	bitvec_write_field(dest, wp,0x0,5); // GAMMA_TN7
+	for (i = 0; i < 8; i++)
+		bitvec_write_field(dest, wp,(tn == i),1); // switch GAMMA_TN[i] = on or off
+	bitvec_write_field(dest, wp,0x0,5); // GAMMA_TN[tn]
 
 	bitvec_write_field(dest, wp,0x0,1); // TBF Starting TIME IE not present
 	bitvec_write_field(dest, wp,0x0,1); // Measurement Mapping struct not present
@@ -606,7 +649,7 @@ void  write_packet_uplink_assignment(bitvec * dest, uint8_t tfi, uint32_t tlli)
 	bitvec_write_field(dest, wp,0x0,1); // Dynamic Allocation
 	bitvec_write_field(dest, wp,0x0,1); // P0 = off
 	
-	bitvec_write_field(dest, wp,0x1,1); // USF_GRANULARITY
+	bitvec_write_field(dest, wp,0x1,0); // USF_GRANULARITY
 	bitvec_write_field(dest, wp,0x1,1); // switch TFI   : on
 	bitvec_write_field(dest, wp,tfi,5);// TFI
 
@@ -623,7 +666,7 @@ void  write_packet_uplink_assignment(bitvec * dest, uint8_t tfi, uint32_t tlli)
 
 // GSM 04.08 9.1.18 Immediate assignment
 int write_immediate_assignment(bitvec * dest, uint8_t downlink, uint8_t ra, uint32_t fn,
-								uint8_t ta, uint8_t tfi, uint32_t tlli)
+								uint8_t ta, uint16_t arfcn, uint8_t ts, uint8_t tsc, uint8_t tfi, uint32_t tlli)
 {
 	unsigned wp = 0;
 
@@ -641,10 +684,10 @@ int write_immediate_assignment(bitvec * dest, uint8_t downlink, uint8_t ra, uint
 
 	// GSM 04.08 10.5.2.25a Packet Channel Description
 	bitvec_write_field(dest, wp,0x1,5);                               // Channel type
-	bitvec_write_field(dest, wp,(l1fh->fl1h)->channel_info.tn,3);     // TN
-	bitvec_write_field(dest, wp,(l1fh->fl1h)->channel_info.tsc,3);    // TSC
+	bitvec_write_field(dest, wp,ts,3);     // TN
+	bitvec_write_field(dest, wp,tsc,3);    // TSC
 	bitvec_write_field(dest, wp,0x0,3);                               // non-hopping RF channel configuraion
-	bitvec_write_field(dest, wp,(l1fh->fl1h)->channel_info.arfcn,10); // ARFCN
+	bitvec_write_field(dest, wp,arfcn,10); // ARFCN
 
 	//10.5.2.30 Request Reference
 	bitvec_write_field(dest, wp,ra,8);                    // RA
@@ -690,10 +733,10 @@ int write_immediate_assignment(bitvec * dest, uint8_t downlink, uint8_t ra, uint
 		bitvec_write_field(dest, wp, 0, 1);    // POLLING
 		bitvec_write_field(dest, wp, 0, 1);    // ALLOCATION_TYPE: dynamic
 		bitvec_write_field(dest, wp, 1, 3);    // USF
-		bitvec_write_field(dest, wp, 1, 1);    // USF_GRANULARITY
+		bitvec_write_field(dest, wp, 0, 1);    // USF_GRANULARITY
 		bitvec_write_field(dest, wp, 0 , 1);   // "0" power control: Not Present
 		bitvec_write_field(dest, wp, 0, 2);    // CHANNEL_CODING_COMMAND 
-		bitvec_write_field(dest, wp, 1, 1);    // TLLI_BLOCK_CHANNEL_CODING
+		bitvec_write_field(dest, wp, 0, 1);    // TLLI_BLOCK_CHANNEL_CODING
 		bitvec_write_field(dest, wp, 1 , 1);   // "1" Alpha : Present
 		bitvec_write_field(dest, wp, 0, 4);    // Alpha
 		bitvec_write_field(dest, wp, 0, 5);    // Gamma
@@ -782,7 +825,7 @@ void gprs_rlcmac_tx_ul_ack(uint8_t tfi, uint32_t tlli, RlcMacUplinkDataBlock_t *
 	LOGPC(DRLCMAC, LOGL_NOTICE, "\n");
 	LOGP(DRLCMAC, LOGL_NOTICE, "------------------------- TX : Packet Uplink Ack -------------------------\n");
 	free(packet_uplink_ack);
-	pcu_l1if_tx(packet_uplink_ack_vec, GsmL1_Sapi_Pacch);
+	gprs_rlcmac_enqueue_block(packet_uplink_ack_vec, 23);
 	bitvec_free(packet_uplink_ack_vec);
 }
 
@@ -912,7 +955,6 @@ int gprs_rlcmac_rcv_control_block(bitvec *rlc_block)
 	uint8_t tfi = 0;
 	uint32_t tlli = 0;
 	struct gprs_rlcmac_tbf *tbf;
-
 	RlcMacUplink_t * ul_control_block = (RlcMacUplink_t *)malloc(sizeof(RlcMacUplink_t));
 	LOGP(DRLCMAC, LOGL_NOTICE, "+++++++++++++++++++++++++ RX : Uplink Control Block +++++++++++++++++++++++++\n");
 	decode_gsm_rlcmac_uplink(rlc_block, ul_control_block);
@@ -961,9 +1003,54 @@ void gprs_rlcmac_rcv_block(bitvec *rlc_block)
 	}
 }
 
-int gprs_rlcmac_rcv_rach(uint8_t ra, uint32_t Fn, uint16_t ta)
+struct msgb *gen_dummy_msg(uint8_t usf)
+{
+	struct msgb *msg = msgb_alloc(23, "rlcmac_dl_idle");
+	// RLC/MAC filler with USF=1
+	bitvec *filler = bitvec_alloc(23);
+#warning HACK
+	if (usf == 1)
+		bitvec_unhex(filler, "41942b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b");
+	else
+		bitvec_unhex(filler, "42942b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b");
+	bitvec_pack(filler, msgb_put(msg, 23));
+	bitvec_free(filler);
+	return msg;
+}
+
+void gprs_rlcmac_rcv_rts_block(uint8_t trx, uint8_t ts, uint16_t arfcn,
+	uint32_t fn, uint8_t block_nr)
+{
+	struct msgb *msg;
+	
+	set_current_fn(fn);
+	msg = msgb_dequeue(&block_queue);
+	if (!msg)
+		msg = gen_dummy_msg(block_nr ? 2 : 1);
+	pcu_l1if_tx_pdtch(msg, trx, ts, arfcn, fn, block_nr);
+}
+
+int select_pdch(uint8_t *_trx, uint8_t *_ts)
+{
+	uint8_t trx, ts;
+
+	for (trx = 0; trx < 8; trx++) {
+		for (ts = 0; ts < 8; ts++) {
+			if (pcu_l1if_bts.trx[trx].ts[ts].enable) {
+				*_trx = trx;
+				*_ts = ts;
+				return 0;
+			}
+		}
+	}
+
+	return -EBUSY;
+}
+
+int gprs_rlcmac_rcv_rach(uint8_t ra, uint32_t Fn, int16_t qta)
 {
 	struct gprs_rlcmac_tbf *tbf;
+	uint8_t trx, ts;
 
 	static uint8_t prev_ra = 0;
 
@@ -974,7 +1061,7 @@ int gprs_rlcmac_rcv_rach(uint8_t ra, uint32_t Fn, uint16_t ta)
 
 	tbf = tbf_alloc(GPRS_RLCMAC_UL_TBF);
 
-	return tbf_ul_establish(tbf, ra, Fn, ta);
+	return tbf_ul_establish(tbf, ra, Fn, qta);
 }
 
 int gprs_rlcmac_tx_llc_pdus(struct gprs_rlcmac_tbf *tbf)
@@ -1067,7 +1154,7 @@ int gprs_rlcmac_tx_llc_pdus(struct gprs_rlcmac_tbf *tbf)
 				LOGP(DRLCMAC, LOGL_NOTICE, "+++++++++++++++++++++++++ TX : Downlink Data Block +++++++++++++++++++++++++\n");
 				encode_gsm_rlcmac_downlink_data(data_block_vector, data_block);
 				LOGP(DRLCMAC, LOGL_NOTICE, "------------------------- TX : Downlink Data Block -------------------------\n");
-				pcu_l1if_tx(data_block_vector, GsmL1_Sapi_Pdtch);
+				gprs_rlcmac_enqueue_block(data_block_vector, BLOCK_LEN);
 				bitvec_unhex(data_block_vector, "2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b");
 				bsn++;
 				data_block_ready = 0;
@@ -1076,6 +1163,8 @@ int gprs_rlcmac_tx_llc_pdus(struct gprs_rlcmac_tbf *tbf)
 		}
 		while(llc_pdu->len != llc_pdu_index);
 	}
+
+	return 0;
 }
 
 /* Send Uplink unit-data to SGSN. */
@@ -1108,8 +1197,8 @@ void gprs_rlcmac_downlink_assignment(gprs_rlcmac_tbf *tbf)
 	LOGP(DRLCMAC, LOGL_NOTICE, "TX: [PCU -> BTS] TFI: %u TLLI: 0x%08x Immidiate Assignment (CCCH)\n", tbf->tfi, tbf->tlli);
 	bitvec *immediate_assignment = bitvec_alloc(23);
 	bitvec_unhex(immediate_assignment, "2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b");
-	int len = write_immediate_assignment(immediate_assignment, 1, 125, get_current_fn(), (l1fh->fl1h)->channel_info.ta, tbf->tfi, tbf->tlli);
-	pcu_l1if_tx(immediate_assignment, GsmL1_Sapi_Agch, len);
+	int len = write_immediate_assignment(immediate_assignment, 1, 125, get_current_fn(), tbf->ta, tbf->arfcn, tbf->ts, tbf->tsc, tbf->tfi, tbf->tlli);
+	pcu_l1if_tx_agch(immediate_assignment, len);
 	bitvec_free(immediate_assignment);
 }
 
@@ -1118,14 +1207,13 @@ void gprs_rlcmac_packet_downlink_assignment(gprs_rlcmac_tbf *tbf)
 	LOGP(DRLCMAC, LOGL_NOTICE, "TX: [PCU -> BTS] TFI: %u TLLI: 0x%08x Packet DL Assignment\n", tbf->tfi, tbf->tlli);
 	bitvec *packet_downlink_assignment_vec = bitvec_alloc(23);
 	bitvec_unhex(packet_downlink_assignment_vec, "2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b");
-	write_packet_downlink_assignment(packet_downlink_assignment_vec, tbf->tfi, tbf->tlli, (l1fh->fl1h)->channel_info.tn,
-                                                (l1fh->fl1h)->channel_info.ta, (l1fh->fl1h)->channel_info.tsc);
+	write_packet_downlink_assignment(packet_downlink_assignment_vec, tbf->tfi, tbf->tlli, tbf->arfcn, tbf->ts, tbf->ta, tbf->tsc);
 	RlcMacDownlink_t * packet_downlink_assignment = (RlcMacDownlink_t *)malloc(sizeof(RlcMacDownlink_t));
 	LOGP(DRLCMAC, LOGL_NOTICE, "+++++++++++++++++++++++++ TX : Packet Downlink Assignment +++++++++++++++++++++++++\n");
 	decode_gsm_rlcmac_downlink(packet_downlink_assignment_vec, packet_downlink_assignment);
 	LOGPC(DRLCMAC, LOGL_NOTICE, "\n");
 	LOGP(DRLCMAC, LOGL_NOTICE, "------------------------- TX : Packet Downlink Assignment -------------------------\n");
 	free(packet_downlink_assignment);
-	pcu_l1if_tx(packet_downlink_assignment_vec, GsmL1_Sapi_Pacch);
+	gprs_rlcmac_enqueue_block(packet_downlink_assignment_vec, 23);
 	bitvec_free(packet_downlink_assignment_vec);
 }
diff --git a/src/gprs_rlcmac.h b/src/gprs_rlcmac.h
index 7f9e3d7d..60afbbdd 100644
--- a/src/gprs_rlcmac.h
+++ b/src/gprs_rlcmac.h
@@ -76,6 +76,8 @@ struct gprs_rlcmac_tbf {
 	uint8_t rlc_data[LLC_MAX_LEN];
 	uint16_t data_index;
 	uint8_t bsn;
+	uint8_t trx, ts, tsc;
+	uint16_t arfcn, ta;
 	
 	struct osmo_timer_list	timer;
 	unsigned int T; /* Txxxx number */
@@ -96,6 +98,8 @@ enum gprs_rlcmac_block_type {
 
 extern struct llist_head gprs_rlcmac_tbfs;
 
+int select_pdch(uint8_t *_trx, uint8_t *_ts);
+
 int tfi_alloc();
 
 static struct gprs_rlcmac_tbf *tbf_by_tfi(uint8_t tfi, gprs_rlcmac_tbf_direction dir);
@@ -110,7 +114,7 @@ int tbf_add_llc_pdu(struct gprs_rlcmac_tbf *tbf, uint8_t *data, uint16_t llc_pdu
 
 struct gprs_rlcmac_tbf *tbf_alloc(gprs_rlcmac_tbf_direction dir, uint32_t tlli = 0);
 
-int tbf_ul_establish(struct gprs_rlcmac_tbf *tbf, uint8_t ra, uint32_t Fn, uint16_t ta);
+int tbf_ul_establish(struct gprs_rlcmac_tbf *tbf, uint8_t ra, uint32_t Fn, uint16_t qta);
 
 int tbf_dl_establish(struct gprs_rlcmac_tbf *tbf, uint8_t *imsi = NULL);
 
@@ -126,7 +130,7 @@ static void tbf_timer_start(struct gprs_rlcmac_tbf *tbf, unsigned int T, unsigne
 
 static void tbf_gsm_timer_start(struct gprs_rlcmac_tbf *tbf, unsigned int fT, int frames);
 
-int write_immediate_assignment(bitvec * dest, uint8_t downlink, uint8_t ra, uint32_t fn, uint8_t ta, uint8_t tfi, uint32_t tlli = 0);
+int write_immediate_assignment(bitvec * dest, uint8_t downlink, uint8_t ra, uint32_t fn, uint8_t ta, uint16_t arfcn, uint8_t ts, uint8_t tsc, uint8_t tfi, uint32_t tlli = 0);
 
 void gprs_rlcmac_tx_ul_ack(uint8_t tfi, uint32_t tlli, RlcMacUplinkDataBlock_t * ul_data_block);
 
@@ -138,7 +142,10 @@ int gprs_rlcmac_rcv_control_block(bitvec *rlc_block);
 
 void gprs_rlcmac_rcv_block(bitvec *rlc_block);
 
-int gprs_rlcmac_rcv_rach(uint8_t ra, uint32_t Fn, uint16_t ta);
+void gprs_rlcmac_rcv_rts_block(uint8_t trx, uint8_t ts, uint16_t arfcn, 
+        uint32_t fn, uint8_t block_nr);
+
+int gprs_rlcmac_rcv_rach(uint8_t ra, uint32_t Fn, int16_t qta);
 
 int gprs_rlcmac_tx_llc_pdus(struct gprs_rlcmac_tbf *tbf);
 
diff --git a/src/pcu_l1_if.cpp b/src/pcu_l1_if.cpp
index fe933b93..4836e940 100644
--- a/src/pcu_l1_if.cpp
+++ b/src/pcu_l1_if.cpp
@@ -17,12 +17,64 @@
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  */
 
+#include <errno.h>
+#include <string.h>
 #include <gprs_rlcmac.h>
 #include <pcu_l1_if.h>
 #include <gprs_debug.h>
+#include <bitvector.h>
+#include <gsmL1prim.h>
+#include <sys/socket.h>
+#include <linux/in.h>
+extern "C" {
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/write_queue.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/gsm/gsm_utils.h>
+}
 
 #define MAX_UDP_LENGTH 1500
 
+#define msgb_l1prim(msg)	((GsmL1_Prim_t *)(msg)->l1h)
+
+struct femtol1_hdl {
+	struct gsm_time gsm_time;
+	uint32_t hLayer1;			/* handle to the L1 instance in the DSP */
+	uint32_t dsp_trace_f;
+	uint16_t clk_cal;
+	struct llist_head wlc_list;
+
+	void *priv;			/* user reference */
+
+	struct osmo_timer_list alive_timer;
+	unsigned int alive_prim_cnt;
+
+	struct osmo_fd read_ofd;	/* osmo file descriptors */
+	struct osmo_wqueue write_q;
+
+	struct {
+		uint16_t arfcn;
+		uint8_t tn;
+		uint8_t tsc;
+		uint16_t ta;
+	} channel_info;
+
+};
+
+struct l1fwd_hdl {
+	struct sockaddr_storage remote_sa;
+	socklen_t remote_sa_len;
+
+	struct osmo_wqueue udp_wq;
+
+	struct femtol1_hdl *fl1h;
+};
+
+struct l1fwd_hdl *l1fh = talloc_zero(NULL, struct l1fwd_hdl);
+
+struct pcu_l1if_bts pcu_l1if_bts;
+
 // Variable for storage current FN.
 int frame_number;
 
@@ -46,34 +98,31 @@ struct msgb *l1p_msgb_alloc(void)
 	return msg;
 }
 
-struct msgb *gen_dummy_msg(void)
+// Send RLC/MAC block to OpenBTS.
+void pcu_l1if_tx_pdtch(msgb *msg, uint8_t trx, uint8_t ts, uint16_t arfcn,
+        uint32_t fn, uint8_t block_nr)
 {
-	struct msgb *msg = l1p_msgb_alloc();
-	GsmL1_Prim_t *prim = msgb_l1prim(msg);
-	// RLC/MAC filler with USF=1
-	bitvec *filler = bitvec_alloc(23);
-	bitvec_unhex(filler, "41942b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b");
+	struct msgb *nmsg = l1p_msgb_alloc();
+	GsmL1_Prim_t *prim = msgb_l1prim(nmsg);
+	
 	prim->id = GsmL1_PrimId_PhDataReq;
-	prim->u.phDataReq.sapi = GsmL1_Sapi_Pacch;
-	bitvec_pack(filler, prim->u.phDataReq.msgUnitParam.u8Buffer);
-	prim->u.phDataReq.msgUnitParam.u8Size = filler->data_len;
-	bitvec_free(filler);
-	return msg;
+	prim->u.phDataReq.sapi = GsmL1_Sapi_Pdtch;
+	memcpy(prim->u.phDataReq.msgUnitParam.u8Buffer, msg->data, msg->len);
+	prim->u.phDataReq.msgUnitParam.u8Size = msg->len;
+	osmo_wqueue_enqueue(&l1fh->udp_wq, nmsg);
+	msgb_free(msg);
 }
 
-// Send RLC/MAC block to OpenBTS.
-void pcu_l1if_tx(bitvec * block, GsmL1_Sapi_t sapi, int len)
+void pcu_l1if_tx_agch(bitvec * block, int len)
 {
 	struct msgb *msg = l1p_msgb_alloc();
-	struct osmo_wqueue * queue;
-	queue = &((l1fh->fl1h)->write_q);
 	GsmL1_Prim_t *prim = msgb_l1prim(msg);
 	
 	prim->id = GsmL1_PrimId_PhDataReq;
-	prim->u.phDataReq.sapi = sapi;
+	prim->u.phDataReq.sapi = GsmL1_Sapi_Agch;
 	bitvec_pack(block, prim->u.phDataReq.msgUnitParam.u8Buffer);
 	prim->u.phDataReq.msgUnitParam.u8Size = len;
-	osmo_wqueue_enqueue(queue, msg);
+	osmo_wqueue_enqueue(&l1fh->udp_wq, msg);
 }
 
 int pcu_l1if_rx_pdch(GsmL1_PhDataInd_t *data_ind)
@@ -82,31 +131,27 @@ int pcu_l1if_rx_pdch(GsmL1_PhDataInd_t *data_ind)
 	bitvec_unpack(block, data_ind->msgUnitParam.u8Buffer);
 	gprs_rlcmac_rcv_block(block);
 	bitvec_free(block);
+
+	return 0;
 }
 
 static int handle_ph_connect_ind(struct femtol1_hdl *fl1, GsmL1_PhConnectInd_t *connect_ind)
 {
+	pcu_l1if_bts.trx[0].arfcn = connect_ind->u16Arfcn;
+	pcu_l1if_bts.trx[0].ts[connect_ind->u8Tn].enable = 1;
+	pcu_l1if_bts.trx[0].ts[connect_ind->u8Tn].tsc = connect_ind->u8Tsc;
 	(l1fh->fl1h)->channel_info.arfcn = connect_ind->u16Arfcn;
 	(l1fh->fl1h)->channel_info.tn = connect_ind->u8Tn;
 	(l1fh->fl1h)->channel_info.tsc = connect_ind->u8Tsc;
 	LOGP(DL1IF, LOGL_NOTICE, "RX: [ PCU <- BTS ] PhConnectInd: ARFCN: %u TN: %u TSC: %u \n",
 	        connect_ind->u16Arfcn, (unsigned)connect_ind->u8Tn, (unsigned)connect_ind->u8Tsc);
+
+	return 0;
 }
 
 static int handle_ph_readytosend_ind(struct femtol1_hdl *fl1, GsmL1_PhReadyToSendInd_t *readytosend_ind)
 {
-	struct msgb *resp_msg;
-	struct osmo_wqueue * queue;
-	queue = &((l1fh->fl1h)->write_q);
-	
-	set_current_fn(readytosend_ind->u32Fn);
-	resp_msg = msgb_dequeue(&queue->msg_queue);
-	if (!resp_msg) {
-		resp_msg = gen_dummy_msg();
-		if (!resp_msg)
-			return 0;
-	}
-	osmo_wqueue_enqueue(&l1fh->udp_wq, resp_msg);
+	gprs_rlcmac_rcv_rts_block(0,0, (l1fh->fl1h)->channel_info.arfcn, readytosend_ind->u32Fn, 0);
 	return 1;
 }
 
@@ -172,3 +217,104 @@ int pcu_l1if_handle_l1prim(struct femtol1_hdl *fl1, struct msgb *msg)
 
 	return rc;
 }
+
+/* OpenBTS socket functions */
+
+// TODO: We should move this parameters to config file.
+#define PCU_L1_IF_PORT 5944
+
+/* data has arrived on the udp socket */
+static int udp_read_cb(struct osmo_fd *ofd)
+{
+	struct msgb *msg = msgb_alloc_headroom(2048, 128, "udp_rx");
+	struct l1fwd_hdl *l1fh = (l1fwd_hdl *)ofd->data;
+	struct femtol1_hdl *fl1h = l1fh->fl1h;
+	int rc;
+
+	if (!msg)
+		return -ENOMEM;
+
+	msg->l1h = msg->data;
+
+	l1fh->remote_sa_len = sizeof(l1fh->remote_sa);
+	rc = recvfrom(ofd->fd, msg->l1h, msgb_tailroom(msg), 0,
+			(struct sockaddr *) &l1fh->remote_sa, &l1fh->remote_sa_len);
+	if (rc < 0) {
+		perror("read from udp");
+		msgb_free(msg);
+		return rc;
+	} else if (rc == 0) {
+		perror("len=0 read from udp");
+		msgb_free(msg);
+		return rc;
+	}
+	msgb_put(msg, rc);
+
+	rc = pcu_l1if_handle_l1prim(fl1h, msg);
+	return rc;
+}
+
+/* callback when we can write to the UDP socket */
+static int udp_write_cb(struct osmo_fd *ofd, struct msgb *msg)
+{
+	int rc;
+	struct l1fwd_hdl *l1fh = (l1fwd_hdl *)ofd->data;
+
+	//DEBUGP(DGPRS, "UDP: Writing %u bytes for MQ_L1_WRITE queue\n", msgb_l1len(msg));
+
+	rc = sendto(ofd->fd, msg->l1h, msgb_l1len(msg), 0,
+			(const struct sockaddr *)&l1fh->remote_sa, l1fh->remote_sa_len);
+	if (rc < 0) {
+		LOGP(DPCU, LOGL_ERROR, "error writing to L1 msg_queue: %s\n",
+			strerror(errno));
+		return rc;
+	} else if (rc < (int)msgb_l1len(msg)) {
+		LOGP(DPCU, LOGL_ERROR, "short write to L1 msg_queue: "
+			"%u < %u\n", rc, msgb_l1len(msg));
+		return -EIO;
+	}
+
+	return 0;
+}
+
+int pcu_l1if_open()
+{
+	//struct l1fwd_hdl *l1fh;
+	struct femtol1_hdl *fl1h;
+	int rc;
+
+	memset(&pcu_l1if_bts, 0, sizeof(pcu_l1if_bts));
+
+	/* allocate new femtol1_handle */
+	fl1h = talloc_zero(NULL, struct femtol1_hdl);
+	INIT_LLIST_HEAD(&fl1h->wlc_list);
+
+	l1fh->fl1h = fl1h;
+	fl1h->priv = l1fh;
+
+	struct osmo_wqueue * queue = &((l1fh->fl1h)->write_q);
+	osmo_wqueue_init(queue, 10);
+	queue->bfd.when |= BSC_FD_READ;
+	queue->bfd.data = l1fh;
+	queue->bfd.priv_nr = 0;
+
+	/* Open UDP */
+	struct osmo_wqueue *wq = &l1fh->udp_wq;
+
+	osmo_wqueue_init(wq, 10);
+	wq->write_cb = udp_write_cb;
+	wq->read_cb = udp_read_cb;
+	wq->bfd.when |= BSC_FD_READ;
+	wq->bfd.data = l1fh;
+	wq->bfd.priv_nr = 0;
+	rc = osmo_sock_init_ofd(&wq->bfd, AF_UNSPEC, SOCK_DGRAM,
+				IPPROTO_UDP, NULL, PCU_L1_IF_PORT,
+				OSMO_SOCK_F_BIND);
+	if (rc < 0) {
+		perror("sock_init");
+		exit(1);
+	}
+
+	return 0;
+}
+
diff --git a/src/pcu_l1_if.h b/src/pcu_l1_if.h
index efe533e7..241f4943 100644
--- a/src/pcu_l1_if.h
+++ b/src/pcu_l1_if.h
@@ -20,58 +20,41 @@
 #ifndef PCU_L1_IF_H
 #define PCU_L1_IF_H
 
-
-#include <bitvector.h>
-#include <gsmL1prim.h>
-#include <sys/socket.h>
+#include <stdint.h>
 extern "C" {
 #include <osmocom/core/write_queue.h>
 #include <osmocom/core/socket.h>
 #include <osmocom/core/timer.h>
+#include <osmocom/core/bitvec.h>
 #include <osmocom/gsm/gsm_utils.h>
 }
 
-#define msgb_l1prim(msg)	((GsmL1_Prim_t *)(msg)->l1h)
-
-struct femtol1_hdl {
-	struct gsm_time gsm_time;
-	uint32_t hLayer1;			/* handle to the L1 instance in the DSP */
-	uint32_t dsp_trace_f;
-	uint16_t clk_cal;
-	struct llist_head wlc_list;
-
-	void *priv;			/* user reference */
-
-	struct osmo_timer_list alive_timer;
-	unsigned int alive_prim_cnt;
-
-	struct osmo_fd read_ofd;	/* osmo file descriptors */
-	struct osmo_wqueue write_q;
-
-	struct {
-		uint16_t arfcn;
-		uint8_t tn;
-		uint8_t tsc;
-		uint16_t ta;
-	} channel_info;
-
+struct pcu_l1if_ts {
+	uint8_t enable;
+	uint8_t tsc;
 };
 
-struct l1fwd_hdl {
-	struct sockaddr_storage remote_sa;
-	socklen_t remote_sa_len;
-
-	struct osmo_wqueue udp_wq;
+struct pcu_l1if_trx {
+	uint16_t arfcn;
+	struct pcu_l1if_ts ts[8];
+};
 
-	struct femtol1_hdl *fl1h;
+struct pcu_l1if_bts {
+	struct pcu_l1if_trx trx[8];
 };
 
-extern struct l1fwd_hdl *l1fh;
+extern struct pcu_l1if_bts pcu_l1if_bts;
 
 int get_current_fn();
+void set_current_fn(int fn);
 
-void pcu_l1if_tx(bitvec * block, GsmL1_Sapi_t sapi, int len = 23);
+void pcu_l1if_tx_pdtch(msgb *msg, uint8_t trx, uint8_t ts, uint16_t arfcn, 
+        uint32_t fn, uint8_t block_nr);
+void pcu_l1if_tx_ptcch(msgb *msg, uint8_t trx, uint8_t ts, uint16_t arfcn, 
+        uint32_t fn, uint8_t block_nr);
+void pcu_l1if_tx_agch(bitvec * block, int len);
 
-int pcu_l1if_handle_l1prim(struct femtol1_hdl *fl1h, struct msgb *msg);
+int pcu_l1if_open(void);
+void pcu_l1if_close(void);
 
 #endif // PCU_L1_IF_H
diff --git a/src/pcu_main.cpp b/src/pcu_main.cpp
index 60307e5c..fa1ffb19 100644
--- a/src/pcu_main.cpp
+++ b/src/pcu_main.cpp
@@ -27,9 +27,6 @@
 #define SGSN_IP "127.0.0.1"
 #define SGSN_PORT 23000
 #define NSVCI 4
-#define PCU_L1_IF_PORT 5944
-
-struct l1fwd_hdl *l1fh = talloc_zero(NULL, struct l1fwd_hdl);
 
 int sgsn_ns_cb(enum gprs_ns_evt event, struct gprs_nsvc *nsvc, struct msgb *msg, uint16_t bvci)
 {
@@ -49,97 +46,6 @@ int sgsn_ns_cb(enum gprs_ns_evt event, struct gprs_nsvc *nsvc, struct msgb *msg,
 	return rc;
 }
 
-/* data has arrived on the udp socket */
-static int udp_read_cb(struct osmo_fd *ofd)
-{
-	struct msgb *msg = msgb_alloc_headroom(2048, 128, "udp_rx");
-	struct l1fwd_hdl *l1fh = (l1fwd_hdl *)ofd->data;
-	struct femtol1_hdl *fl1h = l1fh->fl1h;
-	int rc;
-
-	if (!msg)
-		return -ENOMEM;
-
-	msg->l1h = msg->data;
-
-	l1fh->remote_sa_len = sizeof(l1fh->remote_sa);
-	rc = recvfrom(ofd->fd, msg->l1h, msgb_tailroom(msg), 0,
-			(struct sockaddr *) &l1fh->remote_sa, &l1fh->remote_sa_len);
-	if (rc < 0) {
-		perror("read from udp");
-		msgb_free(msg);
-		return rc;
-	} else if (rc == 0) {
-		perror("len=0 read from udp");
-		msgb_free(msg);
-		return rc;
-	}
-	msgb_put(msg, rc);
-
-	rc = pcu_l1if_handle_l1prim(fl1h, msg);
-	return rc;
-}
-
-/* callback when we can write to the UDP socket */
-static int udp_write_cb(struct osmo_fd *ofd, struct msgb *msg)
-{
-	int rc;
-	struct l1fwd_hdl *l1fh = (l1fwd_hdl *)ofd->data;
-
-	//DEBUGP(DGPRS, "UDP: Writing %u bytes for MQ_L1_WRITE queue\n", msgb_l1len(msg));
-
-	rc = sendto(ofd->fd, msg->l1h, msgb_l1len(msg), 0,
-			(const struct sockaddr *)&l1fh->remote_sa, l1fh->remote_sa_len);
-	if (rc < 0) {
-		LOGP(DPCU, LOGL_ERROR, "error writing to L1 msg_queue: %s\n",
-			strerror(errno));
-		return rc;
-	} else if (rc < msgb_l1len(msg)) {
-		LOGP(DPCU, LOGL_ERROR, "short write to L1 msg_queue: "
-			"%u < %u\n", rc, msgb_l1len(msg));
-		return -EIO;
-	}
-
-	return 0;
-}
-
-int pcu_l1if_open()
-{
-	//struct l1fwd_hdl *l1fh;
-	struct femtol1_hdl *fl1h;
-	int rc;
-
-	/* allocate new femtol1_handle */
-	fl1h = talloc_zero(NULL, struct femtol1_hdl);
-	INIT_LLIST_HEAD(&fl1h->wlc_list);
-
-	l1fh->fl1h = fl1h;
-	fl1h->priv = l1fh;
-
-	struct osmo_wqueue * queue = &((l1fh->fl1h)->write_q);
-	osmo_wqueue_init(queue, 10);
-	queue->bfd.when |= BSC_FD_READ;
-	queue->bfd.data = l1fh;
-	queue->bfd.priv_nr = 0;
-
-	/* Open UDP */
-	struct osmo_wqueue *wq = &l1fh->udp_wq;
-
-	osmo_wqueue_init(wq, 10);
-	wq->write_cb = udp_write_cb;
-	wq->read_cb = udp_read_cb;
-	wq->bfd.when |= BSC_FD_READ;
-	wq->bfd.data = l1fh;
-	wq->bfd.priv_nr = 0;
-	rc = osmo_sock_init_ofd(&wq->bfd, AF_UNSPEC, SOCK_DGRAM,
-				IPPROTO_UDP, NULL, PCU_L1_IF_PORT,
-				OSMO_SOCK_F_BIND);
-	if (rc < 0) {
-		perror("sock_init");
-		exit(1);
-	}
-}
-
 int main(int argc, char *argv[])
 {
 	uint16_t nsvci = NSVCI;
diff --git a/src/sysmo_l1_if.cpp b/src/sysmo_l1_if.cpp
new file mode 100644
index 00000000..09a31495
--- /dev/null
+++ b/src/sysmo_l1_if.cpp
@@ -0,0 +1,562 @@
+/* sysmo_l1_if.cpp
+ *
+ * Copyright (C) 2012 Andreas Eversberg <jolly@eversberg.eu>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <assert.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+extern "C" {
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/msgb.h>
+}
+
+#include <gprs_rlcmac.h>
+#include <pcu_l1_if.h>
+#include <gprs_debug.h>
+#include "../../osmo-bts/include/osmo-bts/pcuif_proto.h"
+
+static int pcu_sock_send(struct msgb *msg);
+static void pcu_sock_timeout(void *_priv);
+
+struct pcu_l1if_bts pcu_l1if_bts;
+
+// Variable for storage current FN.
+int frame_number;
+
+int get_current_fn()
+{
+	return frame_number;
+}
+
+void set_current_fn(int fn)
+{
+	frame_number = fn;
+}
+
+/*
+ * PCU messages
+ */
+
+struct msgb *pcu_msgb_alloc(uint8_t msg_type, uint8_t bts_nr)
+{
+	struct msgb *msg;
+	struct gsm_pcu_if *pcu_prim;
+
+	msg = msgb_alloc(sizeof(struct gsm_pcu_if), "pcu_sock_tx");
+	if (!msg)
+		return NULL;
+	msgb_put(msg, sizeof(struct gsm_pcu_if));
+	pcu_prim = (struct gsm_pcu_if *) msg->data;
+	pcu_prim->msg_type = msg_type;
+	pcu_prim->bts_nr = bts_nr;
+
+	return msg;
+}
+
+static int pcu_tx_act_req(uint8_t trx, uint8_t ts, uint8_t activate)
+{
+	struct msgb *msg;
+	struct gsm_pcu_if *pcu_prim;
+	struct gsm_pcu_if_act_req *act_req;
+
+	LOGP(DL1IF, LOGL_INFO, "Sending %s request: trx=%d ts=%d\n",
+		(activate) ? "activate" : "deactivate", trx, ts);
+
+	msg = pcu_msgb_alloc(PCU_IF_MSG_ACT_REQ, 0);
+	if (!msg)
+		return -ENOMEM;
+	pcu_prim = (struct gsm_pcu_if *) msg->data;
+	act_req = &pcu_prim->u.act_req;
+	act_req->activate = activate;
+	act_req->trx_nr = trx;
+	act_req->ts_nr = ts;
+
+	return pcu_sock_send(msg);
+}
+
+static int pcu_tx_data_req(uint8_t trx, uint8_t ts, uint8_t sapi,
+	uint16_t arfcn, uint32_t fn, uint8_t block_nr, uint8_t *data,
+	uint8_t len)
+{
+	struct msgb *msg;
+	struct gsm_pcu_if *pcu_prim;
+	struct gsm_pcu_if_data *data_req;
+
+	LOGP(DL1IF, LOGL_DEBUG, "Sending data request: trx=%d ts=%d sapi=%d "
+		"arfcn=%d fn=%d block=%d data=%s\n", trx, ts, sapi, arfcn, fn,
+		block_nr, osmo_hexdump(data, len));
+
+	msg = pcu_msgb_alloc(PCU_IF_MSG_DATA_REQ, 0);
+	if (!msg)
+		return -ENOMEM;
+	pcu_prim = (struct gsm_pcu_if *) msg->data;
+	data_req = &pcu_prim->u.data_req;
+
+	data_req->sapi = sapi;
+	data_req->fn = fn;
+	data_req->arfcn = arfcn;
+	data_req->trx_nr = trx;
+	data_req->ts_nr = ts;
+	data_req->block_nr = block_nr;
+	memcpy(data_req->data, data, len);
+	data_req->len = len;
+
+	return pcu_sock_send(msg);
+}
+
+void pcu_l1if_tx_pdtch(msgb *msg, uint8_t trx, uint8_t ts, uint16_t arfcn,
+	uint32_t fn, uint8_t block_nr)
+{
+	pcu_tx_data_req(trx, ts, PCU_IF_SAPI_PDTCH, arfcn, fn, block_nr,
+		msg->data, msg->len);
+	msgb_free(msg);
+}
+
+void pcu_l1if_tx_ptcch(msgb *msg, uint8_t trx, uint8_t ts, uint16_t arfcn,
+	uint32_t fn, uint8_t block_nr)
+{
+	pcu_tx_data_req(trx, ts, PCU_IF_SAPI_PTCCH, arfcn, fn, block_nr,
+		msg->data, msg->len);
+	msgb_free(msg);
+}
+
+void pcu_l1if_tx_agch(bitvec * block, int len)
+{
+	uint8_t data[24]; /* prefix PLEN */
+	
+	/* FIXME: why does OpenBTS has no PLEN and no fill in message? */
+	bitvec_pack(block, data + 1);
+	data[0] = (len << 2) | 0x01;
+	pcu_tx_data_req(0, 0, PCU_IF_SAPI_AGCH, 0, 0, 0, data, 23);
+}
+
+static void pcu_l1if_tx_bcch(uint8_t *data, int len)
+{
+	pcu_tx_data_req(0, 0, PCU_IF_SAPI_BCCH, 0, 0, 0, data, len);
+}
+
+static int pcu_rx_data_ind(struct gsm_pcu_if_data *data_ind)
+{
+	int rc = 0;
+	bitvec *block;
+
+	LOGP(DL1IF, LOGL_DEBUG, "Data indication received: sapi=%d arfcn=%d "
+		"block=%d data=%s\n", data_ind->sapi,
+		data_ind->arfcn, data_ind->block_nr,
+		osmo_hexdump(data_ind->data, data_ind->len));
+
+	switch (data_ind->sapi) {
+	case PCU_IF_SAPI_PDTCH:
+		block = bitvec_alloc(data_ind->len);
+		if (!block) {
+			rc = -ENOMEM;
+			break;
+		}
+		bitvec_unpack(block, data_ind->data);
+		gprs_rlcmac_rcv_block(block);
+		bitvec_free(block);
+		break;
+	default:
+		LOGP(DL1IF, LOGL_ERROR, "Received PCU data indication with "
+			"unsupported sapi %d\n", data_ind->sapi);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int pcu_rx_rts_req(struct gsm_pcu_if_rts_req *rts_req)
+{
+	int rc = 0;
+
+	LOGP(DL1IF, LOGL_DEBUG, "RTS request received: trx=%d ts=%d sapi=%d "
+		"arfcn=%d fn=%d block=%d\n", rts_req->trx_nr, rts_req->ts_nr,
+		rts_req->sapi, rts_req->arfcn, rts_req->fn, rts_req->block_nr);
+
+	switch (rts_req->sapi) {
+	case PCU_IF_SAPI_PDTCH:
+		gprs_rlcmac_rcv_rts_block(rts_req->trx_nr, rts_req->ts_nr,
+			rts_req->arfcn, rts_req->fn, rts_req->block_nr);
+		break;
+	case PCU_IF_SAPI_PTCCH:
+		/* FIXME */
+		{
+			struct msgb *msg = msgb_alloc(23, "l1_prim");
+			memset(msgb_put(msg, 23), 0x2b, 23);
+			pcu_l1if_tx_ptcch(msg, rts_req->trx_nr, rts_req->ts_nr,
+				rts_req->arfcn, rts_req->fn, rts_req->block_nr);
+		}
+		break;
+	default:
+		LOGP(DL1IF, LOGL_ERROR, "Received PCU RTS request with "
+			"unsupported sapi %d\n", rts_req->sapi);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int pcu_rx_rach_ind(struct gsm_pcu_if_rach_ind *rach_ind)
+{
+	int rc = 0;
+
+	LOGP(DL1IF, LOGL_INFO, "RACH request received: sapi=%d "
+		"qta=%d, ra=%d, fn=%d\n", rach_ind->sapi, rach_ind->qta,
+		rach_ind->ra, rach_ind->fn);
+
+	switch (rach_ind->sapi) {
+	case PCU_IF_SAPI_RACH:
+		rc = gprs_rlcmac_rcv_rach(rach_ind->ra, rach_ind->fn,
+			rach_ind->qta);
+		break;
+	default:
+		LOGP(DL1IF, LOGL_ERROR, "Received PCU rach request with "
+			"unsupported sapi %d\n", rach_ind->sapi);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int pcu_rx_info_ind(struct gsm_pcu_if_info_ind *info_ind)
+{
+	int rc = 0;
+	int trx, ts;
+//	uint8_t si13[23];
+
+	LOGP(DL1IF, LOGL_INFO, "Info indication received:\n");
+
+	if (!(info_ind->flags & PCU_IF_FLAG_ACTIVE)) {
+		LOGP(DL1IF, LOGL_NOTICE, "BTS not available\n");
+		return 0;
+	}
+	LOGP(DL1IF, LOGL_INFO, "BTS available\n");
+
+	for (trx = 0; trx < 8; trx++) {
+		pcu_l1if_bts.trx[trx].arfcn = info_ind->trx[trx].arfcn;
+		for (ts = 0; ts < 8; ts++) {
+			if ((info_ind->trx[trx].pdch_mask & (1 << ts))) {
+				/* FIXME: activate dynamically at RLCMAC */
+				if (!pcu_l1if_bts.trx[trx].ts[ts].enable)
+					pcu_tx_act_req(trx, ts, 1);
+				pcu_l1if_bts.trx[trx].ts[ts].enable = 1;
+				pcu_l1if_bts.trx[trx].ts[ts].tsc =
+					info_ind->trx[trx].tsc[ts];
+				LOGP(DL1IF, LOGL_INFO, "PDCH: trx=%d ts=%d\n",
+					trx, ts);
+			} else {
+				if (pcu_l1if_bts.trx[trx].ts[ts].enable)
+					pcu_tx_act_req(trx, ts, 0);
+				pcu_l1if_bts.trx[trx].ts[ts].enable = 0;
+			}
+		}
+	}
+
+#warning FIXME: RAC
+//	rc = generate_si13(si13, 0 /* rac */);
+//	printf("rc=%d\n", rc);
+//	pcu_l1if_tx_bcch(si13, 23);
+
+	return rc;
+}
+
+static int pcu_rx(uint8_t msg_type, struct gsm_pcu_if *pcu_prim)
+{
+	int rc = 0;
+
+	switch (msg_type) {
+	case PCU_IF_MSG_DATA_IND:
+		rc = pcu_rx_data_ind(&pcu_prim->u.data_ind);
+		break;
+	case PCU_IF_MSG_RTS_REQ:
+		rc = pcu_rx_rts_req(&pcu_prim->u.rts_req);
+		break;
+	case PCU_IF_MSG_RACH_IND:
+		rc = pcu_rx_rach_ind(&pcu_prim->u.rach_ind);
+		break;
+	case PCU_IF_MSG_INFO_IND:
+		rc = pcu_rx_info_ind(&pcu_prim->u.info_ind);
+		break;
+	default:
+		LOGP(DL1IF, LOGL_ERROR, "Received unknwon PCU msg type %d\n",
+			msg_type);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+/*
+ * SYSMO-PCU socket functions
+ */
+
+struct pcu_sock_state {
+	struct osmo_fd conn_bfd;	/* fd for connection to lcr */
+	struct osmo_timer_list timer;	/* socket connect retry timer */
+	struct llist_head upqueue;	/* queue for sending messages */
+} *pcu_sock_state = NULL;
+
+static int pcu_sock_send(struct msgb *msg)
+{
+	struct pcu_sock_state *state = pcu_sock_state;
+	struct osmo_fd *conn_bfd;
+
+	if (!state) {
+		LOGP(DL1IF, LOGL_NOTICE, "PCU socket not created, dropping "
+			"message\n");
+		return -EINVAL;
+	}
+	conn_bfd = &state->conn_bfd;
+	if (conn_bfd->fd <= 0) {
+		LOGP(DL1IF, LOGL_NOTICE, "PCU socket not connected, dropping "
+			"message\n");
+		return -EIO;
+	}
+	msgb_enqueue(&state->upqueue, msg);
+	conn_bfd->when |= BSC_FD_WRITE;
+
+	return 0;
+}
+
+static void pcu_sock_close(struct pcu_sock_state *state)
+{
+	struct osmo_fd *bfd = &state->conn_bfd;
+
+	LOGP(DL1IF, LOGL_NOTICE, "PCU socket has LOST connection\n");
+
+	close(bfd->fd);
+	bfd->fd = -1;
+	osmo_fd_unregister(bfd);
+
+	/* flush the queue */
+	while (!llist_empty(&state->upqueue)) {
+		struct msgb *msg = msgb_dequeue(&state->upqueue);
+		msgb_free(msg);
+	}
+
+	/* disable all slots */
+	memset(&pcu_l1if_bts, 0, sizeof(pcu_l1if_bts));
+
+	state->timer.cb = pcu_sock_timeout;
+	osmo_timer_schedule(&state->timer, 5, 0);
+}
+
+static int pcu_sock_read(struct osmo_fd *bfd)
+{
+	struct pcu_sock_state *state = (struct pcu_sock_state *)bfd->data;
+	struct gsm_pcu_if *pcu_prim;
+	struct msgb *msg;
+	int rc;
+
+	msg = msgb_alloc(sizeof(*pcu_prim), "pcu_sock_rx");
+	if (!msg)
+		return -ENOMEM;
+
+	pcu_prim = (struct gsm_pcu_if *) msg->tail;
+
+	rc = recv(bfd->fd, msg->tail, msgb_tailroom(msg), 0);
+	if (rc == 0)
+		goto close;
+
+	if (rc < 0) {
+		if (errno == EAGAIN)
+			return 0;
+		goto close;
+	}
+
+	rc = pcu_rx(pcu_prim->msg_type, pcu_prim);
+
+	/* as we always synchronously process the message in pcu_rx() and
+	 * its callbacks, we can free the message here. */
+	msgb_free(msg);
+
+	return rc;
+
+close:
+	msgb_free(msg);
+	pcu_sock_close(state);
+	return -1;
+}
+
+static int pcu_sock_write(struct osmo_fd *bfd)
+{
+	struct pcu_sock_state *state = (struct pcu_sock_state *)bfd->data;
+	int rc;
+
+	while (!llist_empty(&state->upqueue)) {
+		struct msgb *msg, *msg2;
+		struct gsm_pcu_if *pcu_prim;
+
+		/* peek at the beginning of the queue */
+		msg = llist_entry(state->upqueue.next, struct msgb, list);
+		pcu_prim = (struct gsm_pcu_if *)msg->data;
+
+		bfd->when &= ~BSC_FD_WRITE;
+
+		/* bug hunter 8-): maybe someone forgot msgb_put(...) ? */
+		if (!msgb_length(msg)) {
+			LOGP(DL1IF, LOGL_ERROR, "message type (%d) with ZERO "
+				"bytes!\n", pcu_prim->msg_type);
+			goto dontsend;
+		}
+
+		/* try to send it over the socket */
+		rc = write(bfd->fd, msgb_data(msg), msgb_length(msg));
+		if (rc == 0)
+			goto close;
+		if (rc < 0) {
+			if (errno == EAGAIN) {
+				bfd->when |= BSC_FD_WRITE;
+				break;
+			}
+			goto close;
+		}
+
+dontsend:
+		/* _after_ we send it, we can deueue */
+		msg2 = msgb_dequeue(&state->upqueue);
+		assert(msg == msg2);
+		msgb_free(msg);
+	}
+	return 0;
+
+close:
+	pcu_sock_close(state);
+
+	return -1;
+}
+
+static int pcu_sock_cb(struct osmo_fd *bfd, unsigned int flags)
+{
+	int rc = 0;
+
+	if (flags & BSC_FD_READ)
+		rc = pcu_sock_read(bfd);
+	if (rc < 0)
+		return rc;
+
+	if (flags & BSC_FD_WRITE)
+		rc = pcu_sock_write(bfd);
+
+	return rc;
+}
+
+int pcu_l1if_open(void)
+{
+	struct pcu_sock_state *state;
+	struct osmo_fd *bfd;
+	struct sockaddr_un local;
+	unsigned int namelen;
+	int rc;
+
+	memset(&pcu_l1if_bts, 0, sizeof(pcu_l1if_bts));
+
+	state = pcu_sock_state;
+	if (!state) {
+		state = talloc_zero(NULL, struct pcu_sock_state);
+		if (!state)
+			return -ENOMEM;
+		INIT_LLIST_HEAD(&state->upqueue);
+	}
+
+	bfd = &state->conn_bfd;
+
+	bfd->fd = socket(AF_UNIX, SOCK_SEQPACKET, 0);
+	if (bfd->fd < 0) {
+		LOGP(DL1IF, LOGL_ERROR, "Failed to create PCU-SYSMO socket.\n");
+		talloc_free(state);
+		return -1;
+	}
+
+	local.sun_family = AF_UNIX;
+	strncpy(local.sun_path, "/tmp/pcu_bts", sizeof(local.sun_path));
+	local.sun_path[sizeof(local.sun_path) - 1] = '\0';
+
+	/* we use the same magic that X11 uses in Xtranssock.c for
+	 * calculating the proper length of the sockaddr */
+#if defined(BSD44SOCKETS) || defined(__UNIXWARE__)
+	local.sun_len = strlen(local.sun_path);
+#endif
+#if defined(BSD44SOCKETS) || defined(SUN_LEN)
+	namelen = SUN_LEN(&local);
+#else
+	namelen = strlen(local.sun_path) +
+		  offsetof(struct sockaddr_un, sun_path);
+#endif
+	rc = connect(bfd->fd, (struct sockaddr *) &local, namelen);
+	if (rc != 0) {
+		LOGP(DL1IF, LOGL_ERROR, "Failed to Connect the PCU-SYSMO "
+			"socket, delaying... '%s'\n", local.sun_path);
+		close(bfd->fd);
+		bfd->fd = -1;
+		state->timer.cb = pcu_sock_timeout;
+		osmo_timer_schedule(&state->timer, 5, 0);
+		return -1;
+	}
+
+	bfd->when = BSC_FD_READ;
+	bfd->cb = pcu_sock_cb;
+	bfd->data = state;
+
+	rc = osmo_fd_register(bfd);
+	if (rc < 0) {
+		LOGP(DL1IF, LOGL_ERROR, "Could not register PCU fd: %d\n", rc);
+		close(bfd->fd);
+		talloc_free(state);
+		return rc;
+	}
+
+	LOGP(DL1IF, LOGL_NOTICE, "PCU-SYSMO socket has been connected\n");
+
+	pcu_sock_state = state;
+
+	return 0;
+}
+
+void pcu_l1if_close(void)
+{
+	struct pcu_sock_state *state = pcu_sock_state;
+	struct osmo_fd *bfd;
+
+	if (!state)
+		return;
+
+	if (osmo_timer_pending(&state->timer))
+		osmo_timer_del(&state->timer);
+
+	bfd = &state->conn_bfd;
+	if (bfd->fd > 0)
+		pcu_sock_close(state);
+	talloc_free(state);
+	pcu_sock_state = NULL;
+}
+
+static void pcu_sock_timeout(void *_priv)
+{
+	pcu_l1if_open();
+}
+
+
+
+