contrib/jenkins: remove broken chroot + qemu code

The mirror where it would download images from is not online anymore, and it looks like this whole block has not been executed in years (we always test the arm builds on native arm machines nowadays, and run all builds in docker). Replace the whole block with a simple check that ensures when arm flags are used, that the build is actually running on an arm machine. Related: OS#6549 Change-Id: I2e204e4a0a7dfcf32f011ed6fb403b564f8155a7
contrib/jenkins: remove duplicate "set -ex"
2025-10-26 01:33:34 +00:00 · 2024-09-12 09:54:09 +02:00 · 2024-09-02 13:04:53 +02:00 · 2024-07-24 16:23:32 +02:00 · 2024-06-26 12:04:00 +02:00 · 2024-06-05 18:34:07 +07:00
167 changed files with 14269 additions and 2811 deletions
--- a/.checkpatch.conf
+++ b/.checkpatch.conf
@@ -0,0 +1,5 @@
+--exclude osmocom-bb/.*
+--exclude .*h
+--exclude Transceiver52M/grgsm_vitac/.*
+--exclude utils/va-test/.*
+--ignore FUNCTION_WITHOUT_ARGS
--- a/.clang-format
+++ b/.clang-format
@@ -0,0 +1,521 @@
+# SPDX-License-Identifier: GPL-2.0
+#
+# clang-format configuration file. Intended for clang-format >= 4.
+#
+# For more information, see:
+#
+#   Documentation/process/clang-format.rst
+#   https://clang.llvm.org/docs/ClangFormat.html
+#   https://clang.llvm.org/docs/ClangFormatStyleOptions.html
+#
+---
+AccessModifierOffset: -4
+AlignAfterOpenBracket: Align
+AlignConsecutiveAssignments: false
+AlignConsecutiveDeclarations: false
+#AlignEscapedNewlines: Left # Unknown to clang-format-4.0
+AlignOperands: true
+AlignTrailingComments: false
+AllowAllParametersOfDeclarationOnNextLine: false
+AllowShortBlocksOnASingleLine: false
+AllowShortCaseLabelsOnASingleLine: false
+AllowShortFunctionsOnASingleLine: None
+AllowShortIfStatementsOnASingleLine: false
+AllowShortLoopsOnASingleLine: false
+AlwaysBreakAfterDefinitionReturnType: None
+AlwaysBreakAfterReturnType: None
+AlwaysBreakBeforeMultilineStrings: false
+AlwaysBreakTemplateDeclarations: true
+BinPackArguments: true
+BinPackParameters: true
+BraceWrapping:
+  AfterClass: false
+  AfterControlStatement: false
+  AfterEnum: false
+  AfterFunction: true
+  AfterNamespace: true
+  AfterObjCDeclaration: false
+  AfterStruct: false
+  AfterUnion: false
+  #AfterExternBlock: false # Unknown to clang-format-5.0
+  BeforeCatch: false
+  BeforeElse: false
+  IndentBraces: false
+  #SplitEmptyFunction: true # Unknown to clang-format-4.0
+  #SplitEmptyRecord: true # Unknown to clang-format-4.0
+  #SplitEmptyNamespace: true # Unknown to clang-format-4.0
+BreakBeforeBinaryOperators: None
+BreakBeforeBraces: Custom
+#BreakBeforeInheritanceComma: false # Unknown to clang-format-4.0
+BreakBeforeTernaryOperators: false
+BreakConstructorInitializersBeforeComma: false
+#BreakConstructorInitializers: BeforeComma # Unknown to clang-format-4.0
+BreakAfterJavaFieldAnnotations: false
+BreakStringLiterals: false
+ColumnLimit: 120
+CommentPragmas: '^ IWYU pragma:'
+#CompactNamespaces: false # Unknown to clang-format-4.0
+ConstructorInitializerAllOnOneLineOrOnePerLine: false
+ConstructorInitializerIndentWidth: 8
+ContinuationIndentWidth: 8
+Cpp11BracedListStyle: false
+DerivePointerAlignment: false
+DisableFormat: false
+ExperimentalAutoDetectBinPacking: false
+#FixNamespaceComments: false # Unknown to clang-format-4.0
+
+# Taken from:
+#   git grep -h '^#define [^[:space:]]*for_each[^[:space:]]*(' include/ \
+#   | sed "s,^#define \([^[:space:]]*for_each[^[:space:]]*\)(.*$,  - '\1'," \
+#   | sort | uniq
+ForEachMacros:
+  - 'apei_estatus_for_each_section'
+  - 'ata_for_each_dev'
+  - 'ata_for_each_link'
+  - '__ata_qc_for_each'
+  - 'ata_qc_for_each'
+  - 'ata_qc_for_each_raw'
+  - 'ata_qc_for_each_with_internal'
+  - 'ax25_for_each'
+  - 'ax25_uid_for_each'
+  - '__bio_for_each_bvec'
+  - 'bio_for_each_bvec'
+  - 'bio_for_each_integrity_vec'
+  - '__bio_for_each_segment'
+  - 'bio_for_each_segment'
+  - 'bio_for_each_segment_all'
+  - 'bio_list_for_each'
+  - 'bip_for_each_vec'
+  - 'bitmap_for_each_clear_region'
+  - 'bitmap_for_each_set_region'
+  - 'blkg_for_each_descendant_post'
+  - 'blkg_for_each_descendant_pre'
+  - 'blk_queue_for_each_rl'
+  - 'bond_for_each_slave'
+  - 'bond_for_each_slave_rcu'
+  - 'bpf_for_each_spilled_reg'
+  - 'btree_for_each_safe128'
+  - 'btree_for_each_safe32'
+  - 'btree_for_each_safe64'
+  - 'btree_for_each_safel'
+  - 'card_for_each_dev'
+  - 'cgroup_taskset_for_each'
+  - 'cgroup_taskset_for_each_leader'
+  - 'cpufreq_for_each_entry'
+  - 'cpufreq_for_each_entry_idx'
+  - 'cpufreq_for_each_valid_entry'
+  - 'cpufreq_for_each_valid_entry_idx'
+  - 'css_for_each_child'
+  - 'css_for_each_descendant_post'
+  - 'css_for_each_descendant_pre'
+  - 'device_for_each_child_node'
+  - 'dma_fence_chain_for_each'
+  - 'drm_atomic_crtc_for_each_plane'
+  - 'drm_atomic_crtc_state_for_each_plane'
+  - 'drm_atomic_crtc_state_for_each_plane_state'
+  - 'drm_atomic_for_each_plane_damage'
+  - 'drm_client_for_each_connector_iter'
+  - 'drm_client_for_each_modeset'
+  - 'drm_connector_for_each_possible_encoder'
+  - 'drm_for_each_bridge_in_chain'
+  - 'drm_for_each_connector_iter'
+  - 'drm_for_each_crtc'
+  - 'drm_for_each_encoder'
+  - 'drm_for_each_encoder_mask'
+  - 'drm_for_each_fb'
+  - 'drm_for_each_legacy_plane'
+  - 'drm_for_each_plane'
+  - 'drm_for_each_plane_mask'
+  - 'drm_for_each_privobj'
+  - 'drm_mm_for_each_hole'
+  - 'drm_mm_for_each_node'
+  - 'drm_mm_for_each_node_in_range'
+  - 'drm_mm_for_each_node_safe'
+  - 'flow_action_for_each'
+  - 'for_each_active_dev_scope'
+  - 'for_each_active_drhd_unit'
+  - 'for_each_active_iommu'
+  - 'for_each_available_child_of_node'
+  - 'for_each_bio'
+  - 'for_each_board_func_rsrc'
+  - 'for_each_bvec'
+  - 'for_each_card_auxs'
+  - 'for_each_card_auxs_safe'
+  - 'for_each_card_components'
+  - 'for_each_card_pre_auxs'
+  - 'for_each_card_prelinks'
+  - 'for_each_card_rtds'
+  - 'for_each_card_rtds_safe'
+  - 'for_each_cgroup_storage_type'
+  - 'for_each_child_of_node'
+  - 'for_each_clear_bit'
+  - 'for_each_clear_bit_from'
+  - 'for_each_cmsghdr'
+  - 'for_each_compatible_node'
+  - 'for_each_component_dais'
+  - 'for_each_component_dais_safe'
+  - 'for_each_comp_order'
+  - 'for_each_console'
+  - 'for_each_cpu'
+  - 'for_each_cpu_and'
+  - 'for_each_cpu_not'
+  - 'for_each_cpu_wrap'
+  - 'for_each_dev_addr'
+  - 'for_each_dev_scope'
+  - 'for_each_displayid_db'
+  - 'for_each_dma_cap_mask'
+  - 'for_each_dpcm_be'
+  - 'for_each_dpcm_be_rollback'
+  - 'for_each_dpcm_be_safe'
+  - 'for_each_dpcm_fe'
+  - 'for_each_drhd_unit'
+  - 'for_each_dss_dev'
+  - 'for_each_efi_handle'
+  - 'for_each_efi_memory_desc'
+  - 'for_each_efi_memory_desc_in_map'
+  - 'for_each_element'
+  - 'for_each_element_extid'
+  - 'for_each_element_id'
+  - 'for_each_endpoint_of_node'
+  - 'for_each_evictable_lru'
+  - 'for_each_fib6_node_rt_rcu'
+  - 'for_each_fib6_walker_rt'
+  - 'for_each_free_mem_pfn_range_in_zone'
+  - 'for_each_free_mem_pfn_range_in_zone_from'
+  - 'for_each_free_mem_range'
+  - 'for_each_free_mem_range_reverse'
+  - 'for_each_func_rsrc'
+  - 'for_each_hstate'
+  - 'for_each_if'
+  - 'for_each_iommu'
+  - 'for_each_ip_tunnel_rcu'
+  - 'for_each_irq_nr'
+  - 'for_each_link_codecs'
+  - 'for_each_link_platforms'
+  - 'for_each_lru'
+  - 'for_each_matching_node'
+  - 'for_each_matching_node_and_match'
+  - 'for_each_member'
+  - 'for_each_memblock'
+  - 'for_each_memblock_type'
+  - 'for_each_memcg_cache_index'
+  - 'for_each_mem_pfn_range'
+  - 'for_each_mem_range'
+  - 'for_each_mem_range_rev'
+  - 'for_each_migratetype_order'
+  - 'for_each_msi_entry'
+  - 'for_each_msi_entry_safe'
+  - 'for_each_net'
+  - 'for_each_net_continue_reverse'
+  - 'for_each_netdev'
+  - 'for_each_netdev_continue'
+  - 'for_each_netdev_continue_rcu'
+  - 'for_each_netdev_continue_reverse'
+  - 'for_each_netdev_feature'
+  - 'for_each_netdev_in_bond_rcu'
+  - 'for_each_netdev_rcu'
+  - 'for_each_netdev_reverse'
+  - 'for_each_netdev_safe'
+  - 'for_each_net_rcu'
+  - 'for_each_new_connector_in_state'
+  - 'for_each_new_crtc_in_state'
+  - 'for_each_new_mst_mgr_in_state'
+  - 'for_each_new_plane_in_state'
+  - 'for_each_new_private_obj_in_state'
+  - 'for_each_node'
+  - 'for_each_node_by_name'
+  - 'for_each_node_by_type'
+  - 'for_each_node_mask'
+  - 'for_each_node_state'
+  - 'for_each_node_with_cpus'
+  - 'for_each_node_with_property'
+  - 'for_each_of_allnodes'
+  - 'for_each_of_allnodes_from'
+  - 'for_each_of_cpu_node'
+  - 'for_each_of_pci_range'
+  - 'for_each_old_connector_in_state'
+  - 'for_each_old_crtc_in_state'
+  - 'for_each_old_mst_mgr_in_state'
+  - 'for_each_oldnew_connector_in_state'
+  - 'for_each_oldnew_crtc_in_state'
+  - 'for_each_oldnew_mst_mgr_in_state'
+  - 'for_each_oldnew_plane_in_state'
+  - 'for_each_oldnew_plane_in_state_reverse'
+  - 'for_each_oldnew_private_obj_in_state'
+  - 'for_each_old_plane_in_state'
+  - 'for_each_old_private_obj_in_state'
+  - 'for_each_online_cpu'
+  - 'for_each_online_node'
+  - 'for_each_online_pgdat'
+  - 'for_each_pci_bridge'
+  - 'for_each_pci_dev'
+  - 'for_each_pci_msi_entry'
+  - 'for_each_populated_zone'
+  - 'for_each_possible_cpu'
+  - 'for_each_present_cpu'
+  - 'for_each_prime_number'
+  - 'for_each_prime_number_from'
+  - 'for_each_process'
+  - 'for_each_process_thread'
+  - 'for_each_property_of_node'
+  - 'for_each_registered_fb'
+  - 'for_each_reserved_mem_region'
+  - 'for_each_rtd_codec_dai'
+  - 'for_each_rtd_codec_dai_rollback'
+  - 'for_each_rtd_components'
+  - 'for_each_set_bit'
+  - 'for_each_set_bit_from'
+  - 'for_each_set_clump8'
+  - 'for_each_sg'
+  - 'for_each_sg_dma_page'
+  - 'for_each_sg_page'
+  - 'for_each_sibling_event'
+  - 'for_each_subelement'
+  - 'for_each_subelement_extid'
+  - 'for_each_subelement_id'
+  - '__for_each_thread'
+  - 'for_each_thread'
+  - 'for_each_wakeup_source'
+  - 'for_each_zone'
+  - 'for_each_zone_zonelist'
+  - 'for_each_zone_zonelist_nodemask'
+  - 'fwnode_for_each_available_child_node'
+  - 'fwnode_for_each_child_node'
+  - 'fwnode_graph_for_each_endpoint'
+  - 'gadget_for_each_ep'
+  - 'genradix_for_each'
+  - 'genradix_for_each_from'
+  - 'hash_for_each'
+  - 'hash_for_each_possible'
+  - 'hash_for_each_possible_rcu'
+  - 'hash_for_each_possible_rcu_notrace'
+  - 'hash_for_each_possible_safe'
+  - 'hash_for_each_rcu'
+  - 'hash_for_each_safe'
+  - 'hctx_for_each_ctx'
+  - 'hlist_bl_for_each_entry'
+  - 'hlist_bl_for_each_entry_rcu'
+  - 'hlist_bl_for_each_entry_safe'
+  - 'hlist_for_each'
+  - 'hlist_for_each_entry'
+  - 'hlist_for_each_entry_continue'
+  - 'hlist_for_each_entry_continue_rcu'
+  - 'hlist_for_each_entry_continue_rcu_bh'
+  - 'hlist_for_each_entry_from'
+  - 'hlist_for_each_entry_from_rcu'
+  - 'hlist_for_each_entry_rcu'
+  - 'hlist_for_each_entry_rcu_bh'
+  - 'hlist_for_each_entry_rcu_notrace'
+  - 'hlist_for_each_entry_safe'
+  - '__hlist_for_each_rcu'
+  - 'hlist_for_each_safe'
+  - 'hlist_nulls_for_each_entry'
+  - 'hlist_nulls_for_each_entry_from'
+  - 'hlist_nulls_for_each_entry_rcu'
+  - 'hlist_nulls_for_each_entry_safe'
+  - 'i3c_bus_for_each_i2cdev'
+  - 'i3c_bus_for_each_i3cdev'
+  - 'ide_host_for_each_port'
+  - 'ide_port_for_each_dev'
+  - 'ide_port_for_each_present_dev'
+  - 'idr_for_each_entry'
+  - 'idr_for_each_entry_continue'
+  - 'idr_for_each_entry_continue_ul'
+  - 'idr_for_each_entry_ul'
+  - 'in_dev_for_each_ifa_rcu'
+  - 'in_dev_for_each_ifa_rtnl'
+  - 'inet_bind_bucket_for_each'
+  - 'inet_lhash2_for_each_icsk_rcu'
+  - 'key_for_each'
+  - 'key_for_each_safe'
+  - 'klp_for_each_func'
+  - 'klp_for_each_func_safe'
+  - 'klp_for_each_func_static'
+  - 'klp_for_each_object'
+  - 'klp_for_each_object_safe'
+  - 'klp_for_each_object_static'
+  - 'kvm_for_each_memslot'
+  - 'kvm_for_each_vcpu'
+  - 'list_for_each'
+  - 'list_for_each_codec'
+  - 'list_for_each_codec_safe'
+  - 'list_for_each_continue'
+  - 'list_for_each_entry'
+  - 'list_for_each_entry_continue'
+  - 'list_for_each_entry_continue_rcu'
+  - 'list_for_each_entry_continue_reverse'
+  - 'list_for_each_entry_from'
+  - 'list_for_each_entry_from_rcu'
+  - 'list_for_each_entry_from_reverse'
+  - 'list_for_each_entry_lockless'
+  - 'list_for_each_entry_rcu'
+  - 'list_for_each_entry_reverse'
+  - 'list_for_each_entry_safe'
+  - 'list_for_each_entry_safe_continue'
+  - 'list_for_each_entry_safe_from'
+  - 'list_for_each_entry_safe_reverse'
+  - 'list_for_each_prev'
+  - 'list_for_each_prev_safe'
+  - 'list_for_each_safe'
+  - 'llist_for_each'
+  - 'llist_for_each_entry'
+  - 'llist_for_each_entry_safe'
+  - 'llist_for_each_safe'
+  - 'mci_for_each_dimm'
+  - 'media_device_for_each_entity'
+  - 'media_device_for_each_intf'
+  - 'media_device_for_each_link'
+  - 'media_device_for_each_pad'
+  - 'nanddev_io_for_each_page'
+  - 'netdev_for_each_lower_dev'
+  - 'netdev_for_each_lower_private'
+  - 'netdev_for_each_lower_private_rcu'
+  - 'netdev_for_each_mc_addr'
+  - 'netdev_for_each_uc_addr'
+  - 'netdev_for_each_upper_dev_rcu'
+  - 'netdev_hw_addr_list_for_each'
+  - 'nft_rule_for_each_expr'
+  - 'nla_for_each_attr'
+  - 'nla_for_each_nested'
+  - 'nlmsg_for_each_attr'
+  - 'nlmsg_for_each_msg'
+  - 'nr_neigh_for_each'
+  - 'nr_neigh_for_each_safe'
+  - 'nr_node_for_each'
+  - 'nr_node_for_each_safe'
+  - 'of_for_each_phandle'
+  - 'of_property_for_each_string'
+  - 'of_property_for_each_u32'
+  - 'pci_bus_for_each_resource'
+  - 'ping_portaddr_for_each_entry'
+  - 'plist_for_each'
+  - 'plist_for_each_continue'
+  - 'plist_for_each_entry'
+  - 'plist_for_each_entry_continue'
+  - 'plist_for_each_entry_safe'
+  - 'plist_for_each_safe'
+  - 'pnp_for_each_card'
+  - 'pnp_for_each_dev'
+  - 'protocol_for_each_card'
+  - 'protocol_for_each_dev'
+  - 'queue_for_each_hw_ctx'
+  - 'radix_tree_for_each_slot'
+  - 'radix_tree_for_each_tagged'
+  - 'rbtree_postorder_for_each_entry_safe'
+  - 'rdma_for_each_block'
+  - 'rdma_for_each_port'
+  - 'resource_list_for_each_entry'
+  - 'resource_list_for_each_entry_safe'
+  - 'rhl_for_each_entry_rcu'
+  - 'rhl_for_each_rcu'
+  - 'rht_for_each'
+  - 'rht_for_each_entry'
+  - 'rht_for_each_entry_from'
+  - 'rht_for_each_entry_rcu'
+  - 'rht_for_each_entry_rcu_from'
+  - 'rht_for_each_entry_safe'
+  - 'rht_for_each_from'
+  - 'rht_for_each_rcu'
+  - 'rht_for_each_rcu_from'
+  - '__rq_for_each_bio'
+  - 'rq_for_each_bvec'
+  - 'rq_for_each_segment'
+  - 'scsi_for_each_prot_sg'
+  - 'scsi_for_each_sg'
+  - 'sctp_for_each_hentry'
+  - 'sctp_skb_for_each'
+  - 'shdma_for_each_chan'
+  - '__shost_for_each_device'
+  - 'shost_for_each_device'
+  - 'sk_for_each'
+  - 'sk_for_each_bound'
+  - 'sk_for_each_entry_offset_rcu'
+  - 'sk_for_each_from'
+  - 'sk_for_each_rcu'
+  - 'sk_for_each_safe'
+  - 'sk_nulls_for_each'
+  - 'sk_nulls_for_each_from'
+  - 'sk_nulls_for_each_rcu'
+  - 'snd_array_for_each'
+  - 'snd_pcm_group_for_each_entry'
+  - 'snd_soc_dapm_widget_for_each_path'
+  - 'snd_soc_dapm_widget_for_each_path_safe'
+  - 'snd_soc_dapm_widget_for_each_sink_path'
+  - 'snd_soc_dapm_widget_for_each_source_path'
+  - 'tb_property_for_each'
+  - 'tcf_exts_for_each_action'
+  - 'udp_portaddr_for_each_entry'
+  - 'udp_portaddr_for_each_entry_rcu'
+  - 'usb_hub_for_each_child'
+  - 'v4l2_device_for_each_subdev'
+  - 'v4l2_m2m_for_each_dst_buf'
+  - 'v4l2_m2m_for_each_dst_buf_safe'
+  - 'v4l2_m2m_for_each_src_buf'
+  - 'v4l2_m2m_for_each_src_buf_safe'
+  - 'virtio_device_for_each_vq'
+  - 'xa_for_each'
+  - 'xa_for_each_marked'
+  - 'xa_for_each_range'
+  - 'xa_for_each_start'
+  - 'xas_for_each'
+  - 'xas_for_each_conflict'
+  - 'xas_for_each_marked'
+  - 'xbc_array_for_each_value'
+  - 'xbc_for_each_key_value'
+  - 'xbc_node_for_each_array_value'
+  - 'xbc_node_for_each_child'
+  - 'xbc_node_for_each_key_value'
+  - 'zorro_for_each_dev'
+
+#IncludeBlocks: Preserve # Unknown to clang-format-5.0
+IncludeCategories:
+  - Regex: '.*'
+    Priority: 1
+IncludeIsMainRegex: '(Test)?$'
+IndentCaseLabels: false
+#IndentPPDirectives: None # Unknown to clang-format-5.0
+IndentWidth: 8
+IndentWrappedFunctionNames: false
+JavaScriptQuotes: Leave
+JavaScriptWrapImports: true
+KeepEmptyLinesAtTheStartOfBlocks: false
+MacroBlockBegin: ''
+MacroBlockEnd: ''
+MaxEmptyLinesToKeep: 1
+NamespaceIndentation: Inner
+#ObjCBinPackProtocolList: Auto # Unknown to clang-format-5.0
+ObjCBlockIndentWidth: 8
+ObjCSpaceAfterProperty: true
+ObjCSpaceBeforeProtocolList: true
+
+# Taken from git's rules
+#PenaltyBreakAssignment: 10 # Unknown to clang-format-4.0
+PenaltyBreakBeforeFirstCallParameter: 30
+PenaltyBreakComment: 10
+PenaltyBreakFirstLessLess: 0
+PenaltyBreakString: 10
+PenaltyExcessCharacter: 100
+PenaltyReturnTypeOnItsOwnLine: 60
+
+PointerAlignment: Right
+ReflowComments: false
+SortIncludes: false
+#SortUsingDeclarations: false # Unknown to clang-format-4.0
+SpaceAfterCStyleCast: false
+SpaceAfterTemplateKeyword: true
+SpaceBeforeAssignmentOperators: true
+#SpaceBeforeCtorInitializerColon: true # Unknown to clang-format-5.0
+#SpaceBeforeInheritanceColon: true # Unknown to clang-format-5.0
+SpaceBeforeParens: ControlStatements
+#SpaceBeforeRangeBasedForLoopColon: true # Unknown to clang-format-5.0
+SpaceInEmptyParentheses: false
+SpacesBeforeTrailingComments: 1
+SpacesInAngles: false
+SpacesInContainerLiterals: false
+SpacesInCStyleCastParentheses: false
+SpacesInParentheses: false
+SpacesInSquareBrackets: false
+Standard: Cpp11
+TabWidth: 8
+UseTab: Always
+...
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -0,0 +1 @@
+open_collective: osmocom
--- a/.gitignore
+++ b/.gitignore
@@ -5,6 +5,18 @@
 Transceiver52M/osmo-trx-uhd
 Transceiver52M/osmo-trx-usrp1
 Transceiver52M/osmo-trx-lms
+Transceiver52M/osmo-trx-ipc
+Transceiver52M/osmo-trx-blade
+Transceiver52M/osmo-trx-ipc2
+Transceiver52M/osmo-trx-syncthing-blade
+Transceiver52M/osmo-trx-syncthing-uhd
+Transceiver52M/osmo-trx-syncthing-ipc
+Transceiver52M/osmo-trx-ms-blade
+Transceiver52M/osmo-trx-ms-uhd
+Transceiver52M/osmo-trx-ms-ipc
+Transceiver52M/device/ipc/uhddev_ipc.cpp
+
+.clang-format

 # tests
 tests/CommonLibs/BitVectorTest
@@ -19,12 +31,14 @@ tests/CommonLibs/VectorTest
 tests/CommonLibs/PRBSTest
 tests/Transceiver52M/convolve_test
 tests/Transceiver52M/LMSDeviceTest
+Transceiver52M/device/ipc/ipc-driver-test

 # automake/autoconf
 *.in
 .deps
 .libs
 .dirstamp
+.version
 *~
 Makefile
 config.log
@@ -60,6 +74,17 @@ doc/manuals/*.pdf
 doc/manuals/*__*.png
 doc/manuals/*.check
 doc/manuals/generated/
-doc/manuals/osmomsc-usermanual.xml
+doc/manuals/vty/osmotrx-*-vty-reference.xml
+doc/manuals/vty/osmotrx-*-vty-reference.xml.inc.gen
+doc/manuals/vty/osmotrx-*-vty-reference.xml.inc.merged
 doc/manuals/common
 doc/manuals/build
+
+contrib/osmo-trx.spec
+!contrib/osmo-trx.spec.in
+
+utils/osmo-prbs-tool
+utils/va-test/osmo-burst-gen
+/.qtc_clangd/*
+/.cache/*
+/.vscode/*
--- a/.gitmodules
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "osmocom-bb"]
+	path = osmocom-bb
+	url = https://gitea.osmocom.org/phone-side/osmocom-bb.git
--- a/CommonLibs/Interthread.h
+++ b/CommonLibs/Interthread.h
@@ -517,7 +517,7 @@ public:
 		@param timeout The blocking timeout in ms.
 		@return Pointer at key or NULL on timeout.
 	*/
-	D* read(const K &key, unsigned timeout) const
+	D* read(const K &key, unsigned timeout)
 	{
 		if (timeout==0) return readNoBlock(key);
 		ScopedLock lock(mLock);
@@ -537,7 +537,7 @@ public:
 		@param key The key to read from.
 		@return Pointer at key.
 	*/
-	D* read(const K &key) const
+	D* read(const K &key)
 	{
 		ScopedLock lock(mLock);
 		typename Map::const_iterator iter = mMap.find(key);
--- a/CommonLibs/Logger.h
+++ b/CommonLibs/Logger.h
@@ -50,19 +50,19 @@ extern "C" {
 #endif

 #define LOG(level) \
-	Log(DMAIN, LOGL_##level, __BASE_FILE__, __LINE__).get() <<  "[tid=" << pthread_self() << "] "
+	Log(DMAIN, LOGL_##level, __BASE_FILE__, __LINE__).get()

 #define LOGC(category, level) \
-	Log(category, LOGL_##level, __BASE_FILE__, __LINE__).get() <<  "[tid=" << pthread_self() << "] "
+	Log(category, LOGL_##level, __BASE_FILE__, __LINE__).get()

 #define LOGLV(category, level) \
-	Log(category, level, __BASE_FILE__, __LINE__).get() <<  "[tid=" << pthread_self() << "] "
+	Log(category, level, __BASE_FILE__, __LINE__).get()

 #define LOGSRC(category, level, file, line) \
-	Log(category, level, file, line).get() <<  "[tid=" << pthread_self() << "] "
+	Log(category, level, file, line).get()

 #define LOGCHAN(chan, category, level) \
-	Log(category, LOGL_##level, __BASE_FILE__, __LINE__).get() <<  "[tid=" << pthread_self() << "][chan=" << chan << "] "
+	Log(category, LOGL_##level, __BASE_FILE__, __LINE__).get() <<  "[chan=" << chan << "] "

 /**
 	A C++ stream-based thread-safe logger.
--- a/CommonLibs/Makefile.am
+++ b/CommonLibs/Makefile.am
@@ -22,8 +22,8 @@
 include $(top_srcdir)/Makefile.common

 AM_CPPFLAGS = $(STD_DEFINES_AND_INCLUDES)
-AM_CXXFLAGS = -Wall -O3 -g -lpthread $(LIBOSMOCORE_CFLAGS) $(LIBOSMOCTRL_CFLAGS) $(LIBOSMOVTY_CFLAGS)
-AM_CFLAGS = $(LIBOSMOCORE_CFLAGS) $(LIBOSMOCTRL_CFLAGS) $(LIBOSMOVTY_CFLAGS)
+AM_CXXFLAGS = -Wall $(LIBOSMOCORE_CFLAGS) $(LIBOSMOCTRL_CFLAGS) $(LIBOSMOVTY_CFLAGS)
+AM_CFLAGS = -Wall $(LIBOSMOCORE_CFLAGS) $(LIBOSMOCTRL_CFLAGS) $(LIBOSMOVTY_CFLAGS)

 noinst_LTLIBRARIES = libcommon.la

@@ -37,7 +37,12 @@ libcommon_la_SOURCES = \
 	trx_rate_ctr.cpp \
 	trx_vty.c \
 	debug.c
-libcommon_la_LIBADD = $(LIBOSMOCORE_LIBS) $(LIBOSMOCTRL_LIBS) $(LIBOSMOVTY_LIBS)
+libcommon_la_LIBADD = \
+	$(LIBOSMOCORE_LIBS) \
+	$(LIBOSMOCTRL_LIBS) \
+	$(LIBOSMOVTY_LIBS) \
+	-lpthread \
+	$(NULL)

 noinst_HEADERS = \
 	BitVector.h \
--- a/CommonLibs/PRBS.h
+++ b/CommonLibs/PRBS.h
@@ -12,10 +12,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #ifndef PRBS_H
--- a/CommonLibs/Threads.cpp
+++ b/CommonLibs/Threads.cpp
@@ -32,11 +32,9 @@
 #include "Timeval.h"
 #include "Logger.h"

-#ifndef gettid
-#include <sys/syscall.h>
-#define gettid() syscall(SYS_gettid)
-#endif
-
+extern "C" {
+#include <osmocom/core/thread.h>
+}

 using namespace std;

@@ -45,76 +43,11 @@ using namespace std;
 #endif


-Mutex gStreamLock;		///< Global lock to control access to cout and cerr.
-
-void lockCout()
-{
-	gStreamLock.lock();
-	Timeval entryTime;
-	cout << entryTime << " " << pthread_self() << ": ";
-}
-
-
-void unlockCout()
-{
-	cout << dec << endl << flush;
-	gStreamLock.unlock();
-}
-
-
-void lockCerr()
-{
-	gStreamLock.lock();
-	Timeval entryTime;
-	cerr << entryTime << " " << pthread_self() << ": ";
-}
-
-void unlockCerr()
-{
-	cerr << dec << endl << flush;
-	gStreamLock.unlock();
-}
-
-
-
-
-
-
-
-Mutex::Mutex()
-{
-	bool res;
-	res = pthread_mutexattr_init(&mAttribs);
-	assert(!res);
-	res = pthread_mutexattr_settype(&mAttribs,PTHREAD_MUTEX_RECURSIVE);
-	assert(!res);
-	res = pthread_mutex_init(&mMutex,&mAttribs);
-	assert(!res);
-}
-
-
-Mutex::~Mutex()
-{
-	pthread_mutex_destroy(&mMutex);
-	bool res = pthread_mutexattr_destroy(&mAttribs);
-	assert(!res);
-}
-
-
-
-
-/** Block for the signal up to the cancellation timeout. */
-void Signal::wait(Mutex& wMutex, unsigned timeout) const
-{
-	Timeval then(timeout);
-	struct timespec waitTime = then.timespec();
-	pthread_cond_timedwait(&mSignal,&wMutex.mMutex,&waitTime);
-}

 void set_selfthread_name(const char *name)
 {
 	pthread_t selfid = pthread_self();
-	pid_t tid = gettid();
+	pid_t tid = osmo_gettid();
 	if (pthread_setname_np(selfid, name) == 0) {
 		LOG(INFO) << "Thread "<< selfid << " (task " << tid << ") set name: " << name;
 	} else {
--- a/CommonLibs/Threads.h
+++ b/CommonLibs/Threads.h
@@ -28,143 +28,96 @@
 #ifndef THREADS_H
 #define THREADS_H

-#include "config.h"
-
+#include <chrono>
+#include <mutex>
+#include <condition_variable>
 #include <pthread.h>
 #include <iostream>
-#include <assert.h>
+#include <cassert>
 #include <unistd.h>

+#include "config.h"
+#include "Timeval.h"
+
 class Mutex;

-
-/**@name Multithreaded access for standard streams. */
-//@{
-
-/**@name Functions for gStreamLock. */
-//@{
-extern Mutex gStreamLock;	///< global lock for cout and cerr
-void lockCerr();		///< call prior to writing cerr
-void unlockCerr();		///< call after writing cerr
-void lockCout();		///< call prior to writing cout
-void unlockCout();		///< call after writing cout
-//@}
-
-/**@name Macros for standard messages. */
-//@{
-#define COUT(text) { lockCout(); std::cout << text; unlockCout(); }
-#define CERR(text) { lockCerr(); std::cerr << __FILE__ << ":" << __LINE__ << ": " << text; unlockCerr(); }
-#ifdef NDEBUG
-#define DCOUT(text) {}
-#define OBJDCOUT(text) {}
-#else
-#define DCOUT(text) { COUT(__FILE__ << ":" << __LINE__ << " " << text); }
-#define OBJDCOUT(text) { DCOUT(this << " " << text); }
-#endif
-//@}
-//@}
-
-
-
 /**@defgroup C++ wrappers for pthread mechanisms. */
 //@{

-/** A class for recursive mutexes based on pthread_mutex. */
+/** A class for recursive mutexes. */
 class Mutex {
+	std::recursive_mutex m;

-	private:
+    public:

-	pthread_mutex_t mMutex;
-	pthread_mutexattr_t mAttribs;
+	void lock() {
+		m.lock();
+	}

-	public:
+	bool trylock() {
+		return m.try_lock();
+	}

-	Mutex();
-
-	~Mutex();
-
-	void lock() { pthread_mutex_lock(&mMutex); }
-
-	bool trylock() { return pthread_mutex_trylock(&mMutex)==0; }
-
-	void unlock() { pthread_mutex_unlock(&mMutex); }
+	void unlock() {
+		m.unlock();
+	}

 	friend class Signal;
-
 };

-
 class ScopedLock {
+	Mutex &mMutex;

-	private:
-	Mutex& mMutex;
-
-	public:
-	ScopedLock(Mutex& wMutex) :mMutex(wMutex) { mMutex.lock(); }
-	~ScopedLock() { mMutex.unlock(); }
-
+    public:
+	ScopedLock(Mutex &wMutex) : mMutex(wMutex) {
+		mMutex.lock();
+	}
+	~ScopedLock() {
+		mMutex.unlock();
+	}
 };

-
-
-
-/** A C++ interthread signal based on pthread condition variables. */
+/** A C++ interthread signal. */
 class Signal {
+	/* any, because for some reason our mutex is recursive... */
+	std::condition_variable_any mSignal;

-	private:
+    public:

-	mutable pthread_cond_t mSignal;
+	void wait(Mutex &wMutex, unsigned timeout) {
+		mSignal.wait_for(wMutex.m, std::chrono::milliseconds(timeout));
+	}

-	public:
+	void wait(Mutex &wMutex) {
+		mSignal.wait(wMutex.m);
+	}

-	Signal() { int s = pthread_cond_init(&mSignal,NULL); assert(!s); }
-
-	~Signal() { pthread_cond_destroy(&mSignal); }
-
-	/**
-		Block for the signal up to the cancellation timeout.
-		Under Linux, spurious returns are possible.
-	*/
-	void wait(Mutex& wMutex, unsigned timeout) const;
-
-	/**
-		Block for the signal.
-		Under Linux, spurious returns are possible.
-	*/
-	void wait(Mutex& wMutex) const
-		{ pthread_cond_wait(&mSignal,&wMutex.mMutex); }
-
-	void signal() { pthread_cond_signal(&mSignal); }
-
-	void broadcast() { pthread_cond_broadcast(&mSignal); }
+	void signal() {
+		mSignal.notify_one();
+	}

+	void broadcast() {
+		mSignal.notify_all();
+	}
 };

-
-
-#define START_THREAD(thread,function,argument) \
-	thread.start((void *(*)(void*))function, (void*)argument);
-
 void set_selfthread_name(const char *name);
 void thread_enable_cancel(bool cancel);

 /** A C++ wrapper for pthread threads.  */
 class Thread {
-
-	private:
-
+    private:
 	pthread_t mThread;
 	pthread_attr_t mAttrib;
 	// FIXME -- Can this be reduced now?
 	size_t mStackSize;

-
-	public:
-
+    public:
 	/** Create a thread in a non-running state. */
-	Thread(size_t wStackSize = 0):mThread((pthread_t)0) {
-		pthread_attr_init(&mAttrib);	// (pat) moved this here.
-		mStackSize=wStackSize;
+	Thread(size_t wStackSize = 0) : mThread((pthread_t)0)
+	{
+		pthread_attr_init(&mAttrib); // (pat) moved this here.
+		mStackSize = wStackSize;
 	}

 	/**
@@ -172,14 +125,17 @@ class Thread {
 		It should be stopped and joined.
 	*/
 	// (pat) If the Thread is destroyed without being started, then mAttrib is undefined.  Oops.
-	~Thread() { pthread_attr_destroy(&mAttrib); }
-
+	~Thread()
+	{
+		pthread_attr_destroy(&mAttrib);
+	}

 	/** Start the thread on a task. */
-	void start(void *(*task)(void*), void *arg);
+	void start(void *(*task)(void *), void *arg);

 	/** Join a thread that will stop on its own. */
-	void join() {
+	void join()
+	{
 		if (mThread) {
 			int s = pthread_join(mThread, NULL);
 			assert(!s);
@@ -187,7 +143,10 @@ class Thread {
 	}

 	/** Send cancellation to thread */
-	void cancel() { pthread_cancel(mThread); }
+	void cancel()
+	{
+		pthread_cancel(mThread);
+	}
 };

 #ifdef HAVE_ATOMIC_OPS
--- a/CommonLibs/Utils.cpp
+++ b/CommonLibs/Utils.cpp
@@ -12,10 +12,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #include <vector>
--- a/CommonLibs/Utils.h
+++ b/CommonLibs/Utils.h
@@ -12,10 +12,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #pragma once
--- a/CommonLibs/Vector.h
+++ b/CommonLibs/Vector.h
@@ -36,6 +36,11 @@
 #include <assert.h>
 #include <stdlib.h>

+#ifndef __OPTIMIZE__
+#define assert_no_opt(x) assert(x)
+#else
+#define assert_no_opt(x)
+#endif
 // We can't use Logger.h in this file...
 extern int gVectorDebug;
 #define BVDEBUG(msg) if (gVectorDebug) {std::cout << msg;}
@@ -81,8 +86,8 @@ template <class T> class Vector {
 	/** Return the size of the Vector. */
 	size_t size() const
 	{
-		assert(mStart>=mData);
-		assert(mEnd>=mStart);
+		assert_no_opt(mStart>=mData);
+		assert_no_opt(mEnd>=mStart);
 		return mEnd - mStart;
 	}

@@ -112,7 +117,7 @@ template <class T> class Vector {
 	/** Reduce addressable size of the Vector, keeping content. */
 	void shrink(size_t newSize)
 	{
-		assert(newSize <= mEnd - mStart);
+		assert_no_opt(newSize <= mEnd - mStart);
 		mEnd = mStart + newSize;
 	}

@@ -199,7 +204,7 @@ template <class T> class Vector {
 	{
 		T* wStart = mStart + start;
 		T* wEnd = wStart + span;
-		assert(wEnd<=mEnd);
+		assert_no_opt(wEnd<=mEnd);
 		return Vector<T>(NULL,wStart,wEnd);
 	}

@@ -208,7 +213,7 @@ template <class T> class Vector {
 	{
 		T* wStart = mStart + start;
 		T* wEnd = wStart + span;
-		assert(wEnd<=mEnd);
+		assert_no_opt(wEnd<=mEnd);
 		return Vector<T>(NULL,wStart,wEnd);
 	}

@@ -228,8 +233,8 @@ template <class T> class Vector {
 		unsigned int i;
 		T* dst = other.mStart + start;
 		T* src = mStart;
-		assert(dst+span<=other.mEnd);
-		assert(mStart+span<=mEnd);
+		assert_no_opt(dst+span<=other.mEnd);
+		assert_no_opt(mStart+span<=mEnd);
 		for (i = 0; i < span; i++, src++, dst++)
 			*dst = *src;
 		/*TODO if not non-trivially copiable type class, optimize:
@@ -250,8 +255,8 @@ template <class T> class Vector {
 	void segmentCopyTo(Vector<T>& other, size_t start, size_t span) const
 	{
 		const T* base = mStart + start;
-		assert(base+span<=mEnd);
-		assert(other.mStart+span<=other.mEnd);
+		assert_no_opt(base+span<=mEnd);
+		assert_no_opt(other.mStart+span<=other.mEnd);
 		memcpy(other.mStart,base,span*sizeof(T));
 	}

@@ -265,8 +270,8 @@ template <class T> class Vector {
 	{
 		const T* baseFrom = mStart + from;
 		T* baseTo = mStart + to;
-		assert(baseFrom+span<=mEnd);
-		assert(baseTo+span<=mEnd);
+		assert_no_opt(baseFrom+span<=mEnd);
+		assert_no_opt(baseTo+span<=mEnd);
 		memmove(baseTo,baseFrom,span*sizeof(T));
 	}

@@ -280,7 +285,7 @@ template <class T> class Vector {
 	{
 		T* dp=mStart+start;
 		T* end=dp+length;
-		assert(end<=mEnd);
+		assert_no_opt(end<=mEnd);
 		while (dp<end) *dp++=val;
 	}

@@ -292,13 +297,13 @@ template <class T> class Vector {

 	T& operator[](size_t index)
 	{
-		assert(mStart+index<mEnd);
+		assert_no_opt(mStart+index<mEnd);
 		return mStart[index];
 	}

 	const T& operator[](size_t index) const
 	{
-		assert(mStart+index<mEnd);
+		assert_no_opt(mStart+index<mEnd);
 		return mStart[index];
 	}

--- a/CommonLibs/config_defs.h
+++ b/CommonLibs/config_defs.h
@@ -5,6 +5,8 @@
 * osmo-trx (CXX, dir Transceiver52)
 */

+#include <stdbool.h>
+
 enum FillerType {
  FILLER_DUMMY,
  FILLER_ZERO,
@@ -18,3 +20,52 @@ enum ReferenceType {
  REF_EXTERNAL,
  REF_GPS,
 };
+
+/* Maximum number of physical RF channels */
+#define TRX_CHAN_MAX 8
+
+struct trx_ctx;
+
+struct trx_chan {
+	struct trx_ctx *trx; /* backpointer */
+	unsigned int idx; /* channel index */
+	char *rx_path;
+	char *tx_path;
+};
+
+struct trx_cfg {
+	char *bind_addr;
+	char *remote_addr;
+	char *dev_args;
+	unsigned int base_port;
+	unsigned int tx_sps;
+	unsigned int rx_sps;
+	unsigned int rtsc;
+	unsigned int rach_delay;
+	enum ReferenceType clock_ref;
+	enum FillerType filler;
+	bool multi_arfcn;
+	double offset;
+	double freq_offset_khz;
+	double rssi_offset;
+	int ul_fn_offset;
+	bool force_rssi_offset; /* Force value set in VTY? */
+	bool swap_channels;
+	bool ext_rach;
+	bool egprs;
+	unsigned int sched_rr;
+	unsigned int stack_size;
+	unsigned int num_chans;
+	struct trx_chan chans[TRX_CHAN_MAX];
+	struct {
+		bool ul_freq_override;
+		bool dl_freq_override;
+		bool ul_gain_override;
+		bool dl_gain_override;
+		double ul_freq;
+		double dl_freq;
+		double ul_gain;
+		double dl_gain;
+	} overrides;
+	bool use_va;
+};
--- a/CommonLibs/debug.c
+++ b/CommonLibs/debug.c
@@ -21,18 +21,6 @@
 * See the COPYING file in the main directory for details.
 */

-#include "config.h"
-
-/* If HAVE_GETTID, then "_GNU_SOURCE" may need to be defined to use gettid() */
-#if HAVE_GETTID
-#define _GNU_SOURCE
-#endif
-
-#include <sys/types.h>
-#include <unistd.h>
-#include <sys/syscall.h>
-#include "config.h"
-
 #include <osmocom/core/logging.h>
 #include <osmocom/core/utils.h>
 #include "debug.h"
@@ -73,7 +61,7 @@ static const struct log_info_cat default_categories[] = {
 		.name = "DDEV",
 		.description = "Device/Driver specific code",
 		.color = NULL,
-		.enabled = 1, .loglevel = LOGL_INFO,
+		.enabled = 1, .loglevel = LOGL_NOTICE,
 	},
 	[DDEVDRV] = {
 		.name = "DDEVDRV",
@@ -81,21 +69,15 @@ static const struct log_info_cat default_categories[] = {
 		.color = NULL,
 		.enabled = 1, .loglevel = LOGL_NOTICE,
 	},
+	[DCTR] = {
+		.name = "DCTR",
+		.description = "Rate counter related logging",
+		.color = NULL,
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
 };

 const struct log_info log_info = {
 	.cat = default_categories,
 	.num_cat = ARRAY_SIZE(default_categories),
 };
-
-pid_t my_gettid(void)
-{
-#if HAVE_GETTID
-	return gettid();
-#elif defined(LINUX) && defined(__NR_gettid)
-	return (pid_t) syscall(__NR_gettid);
-#else
-	#pragma message ("use pid as tid")
-	return getpid();
-#endif
-}
--- a/CommonLibs/debug.h
+++ b/CommonLibs/debug.h
@@ -1,7 +1,6 @@
 #pragma once

 #include <stdbool.h>
-#include <sys/types.h>

 #include <osmocom/core/logging.h>

@@ -16,14 +15,9 @@ enum {
 	DTRXDUL,
 	DDEV,
 	DDEVDRV,
+	DCTR,
 };

-pid_t my_gettid(void);
-
-#define CLOGC(category, level, fmt, args...) do { \
-	LOGP(category, level, "[tid=%ld] " fmt, (long int) my_gettid(), ##args);  \
-} while(0)
-
 #define CLOGCHAN(chan, category, level, fmt, args...) do { \
-	LOGP(category, level, "[tid=%ld][chan=%zu] " fmt, (long int) my_gettid(), chan, ##args);  \
+	LOGP(category, level, "[chan=%zu] " fmt, chan, ##args);  \
 } while(0)
--- a/CommonLibs/osmo_signal.h
+++ b/CommonLibs/osmo_signal.h
@@ -43,6 +43,7 @@ enum SS_DEVICE {
 	   (struct device_counters). Must be sent with PTHREAD_CANCEL_DISABLE
 	   to avoid deadlocks in case osmo-trx process is asked to exit. */
 	S_DEVICE_COUNTER_CHANGE,
+	S_TRX_COUNTER_CHANGE, /* same, but for Transceiver class */
 };

 /* signal cb for signal <SS_DEVICE,S_DEVICE_COUNTER_CHANGE> */
@@ -55,3 +56,16 @@ struct device_counters {
 	unsigned int tx_dropped_events;
 	unsigned int tx_dropped_samples;
 };
+
+/* signal cb for signal <SS_DEVICE,S_TRX_COUNTER_CHANGE> */
+struct trx_counters {
+	size_t chan;
+	unsigned int tx_stale_bursts;
+	unsigned int tx_unavailable_bursts;
+	unsigned int tx_trxd_fn_repeated;
+	unsigned int tx_trxd_fn_outoforder;
+	unsigned int tx_trxd_fn_skipped;
+	unsigned int rx_empty_burst;
+	unsigned int rx_clipping;
+	unsigned int rx_no_burst_detected;
+};
--- a/CommonLibs/trx_rate_ctr.cpp
+++ b/CommonLibs/trx_rate_ctr.cpp
@@ -67,21 +67,24 @@ extern "C" {
 #include "Threads.h"
 #include "Logger.h"

-/* Used in ctrs_pending, when set it means that channel slot contains unused
+/* Used in dev_ctrs_pending, when set it means that channel slot contains unused
   (non-pending) counter data */
 #define PENDING_CHAN_NONE SIZE_MAX

 static void *trx_rate_ctr_ctx;

 static struct rate_ctr_group** rate_ctrs;
-static struct device_counters* ctrs_pending;
+static struct device_counters* dev_ctrs_pending;
+static struct trx_counters* trx_ctrs_pending;
 static size_t chan_len;
-static struct osmo_fd rate_ctr_timerfd;
-static Mutex rate_ctr_mutex;
+static struct osmo_fd dev_rate_ctr_timerfd;
+static struct osmo_fd trx_rate_ctr_timerfd;
+static Mutex dev_rate_ctr_mutex;
+static Mutex trx_rate_ctr_mutex;

 struct osmo_timer_list threshold_timer;
 static LLIST_HEAD(threshold_list);
-static int threshold_timer_sched_secs;
+static unsigned int threshold_timer_sched_secs;
 static bool threshold_initied;

 const struct value_string rate_ctr_intv[] = {
@@ -93,22 +96,38 @@ const struct value_string rate_ctr_intv[] = {
 };

 const struct value_string trx_chan_ctr_names[] = {
-	{ TRX_CTR_RX_OVERRUNS,	"rx_overruns" },
-	{ TRX_CTR_TX_UNDERRUNS,	"tx_underruns" },
-	{ TRX_CTR_RX_DROP_EV,	"rx_drop_events" },
-	{ TRX_CTR_RX_DROP_SMPL,	"rx_drop_samples" },
-	{ TRX_CTR_TX_DROP_EV,	"tx_drop_events" },
-	{ TRX_CTR_TX_DROP_SMPL,	"tx_drop_samples" },
+	{ TRX_CTR_DEV_RX_OVERRUNS,	"rx_overruns" },
+	{ TRX_CTR_DEV_TX_UNDERRUNS,	"tx_underruns" },
+	{ TRX_CTR_DEV_RX_DROP_EV,	"rx_drop_events" },
+	{ TRX_CTR_DEV_RX_DROP_SMPL,	"rx_drop_samples" },
+	{ TRX_CTR_DEV_TX_DROP_EV,	"tx_drop_events" },
+	{ TRX_CTR_DEV_TX_DROP_SMPL,	"tx_drop_samples" },
+	{ TRX_CTR_TRX_TX_STALE_BURSTS,	"tx_stale_bursts" },
+	{ TRX_CTR_TRX_TX_UNAVAILABLE_BURSTS, "tx_unavailable_bursts" },
+	{ TRX_CTR_TRX_TRXD_FN_REPEATED,	"tx_trxd_fn_repeated" },
+	{ TRX_CTR_TRX_TRXD_FN_OUTOFORDER, "tx_trxd_fn_outoforder" },
+	{ TRX_CTR_TRX_TRXD_FN_SKIPPED,	"tx_trxd_fn_skipped" },
+	{ TRX_CTR_TRX_RX_EMPTY_BURST,	"rx_empty_burst" },
+	{ TRX_CTR_TRX_RX_CLIPPING,	"rx_clipping" },
+	{ TRX_CTR_TRX_RX_NO_BURST_DETECTED, "rx_no_burst_detected" },
 	{ 0, NULL }
 };

 static const struct rate_ctr_desc trx_chan_ctr_desc[] = {
-	[TRX_CTR_RX_OVERRUNS]		= { "device:rx_overruns",	"Number of Rx overruns in FIFO queue" },
-	[TRX_CTR_TX_UNDERRUNS]		= { "device:tx_underruns",	"Number of Tx underruns in FIFO queue" },
-	[TRX_CTR_RX_DROP_EV]		= { "device:rx_drop_events",	"Number of times Rx samples were dropped by HW" },
-	[TRX_CTR_RX_DROP_SMPL]		= { "device:rx_drop_samples",	"Number of Rx samples dropped by HW" },
-	[TRX_CTR_TX_DROP_EV]		= { "device:tx_drop_events",	"Number of times Tx samples were dropped by HW" },
-	[TRX_CTR_TX_DROP_SMPL]		= { "device:tx_drop_samples",	"Number of Tx samples dropped by HW" }
+	[TRX_CTR_DEV_RX_OVERRUNS]		= { "device:rx_overruns",	"Number of Rx overruns in FIFO queue" },
+	[TRX_CTR_DEV_TX_UNDERRUNS]		= { "device:tx_underruns",	"Number of Tx underruns in FIFO queue" },
+	[TRX_CTR_DEV_RX_DROP_EV]		= { "device:rx_drop_events",	"Number of times Rx samples were dropped by HW" },
+	[TRX_CTR_DEV_RX_DROP_SMPL]		= { "device:rx_drop_samples",	"Number of Rx samples dropped by HW" },
+	[TRX_CTR_DEV_TX_DROP_EV]		= { "device:tx_drop_events",	"Number of times Tx samples were dropped by HW" },
+	[TRX_CTR_DEV_TX_DROP_SMPL]		= { "device:tx_drop_samples",	"Number of Tx samples dropped by HW" },
+	[TRX_CTR_TRX_TX_STALE_BURSTS]		= { "trx:tx_stale_bursts",	"Number of Tx burts dropped by TRX due to arriving too late" },
+	[TRX_CTR_TRX_TX_UNAVAILABLE_BURSTS]	= { "trx:tx_unavailable_bursts","Number of Tx burts unavailable (not enqueued) at the time they should be transmitted" },
+	[TRX_CTR_TRX_TRXD_FN_REPEATED]		= { "trx:tx_trxd_fn_repeated",	"Number of Tx burts received from TRXD with repeated FN" },
+	[TRX_CTR_TRX_TRXD_FN_OUTOFORDER]	= { "trx:tx_trxd_fn_outoforder","Number of Tx burts received from TRXD with a past FN" },
+	[TRX_CTR_TRX_TRXD_FN_SKIPPED]		= { "trx:tx_trxd_fn_skipped",	"Number of Tx burts potentially skipped due to FN jumps" },
+	[TRX_CTR_TRX_RX_EMPTY_BURST]		= { "trx:rx_empty_burst",	"Number of Rx bursts empty" },
+	[TRX_CTR_TRX_RX_CLIPPING]		= { "trx:rx_clipping",		"Number of Rx bursts discarded due to clipping" },
+	[TRX_CTR_TRX_RX_NO_BURST_DETECTED]	= { "trx:rx_no_burst_detected",	"Number of Rx burts discarded due to burst detection error" },
 };

 static const struct rate_ctr_group_desc trx_chan_ctr_group_desc = {
@@ -119,34 +138,68 @@ static const struct rate_ctr_group_desc trx_chan_ctr_group_desc = {
 	.ctr_desc			= trx_chan_ctr_desc,
 };

-static int rate_ctr_timerfd_cb(struct osmo_fd *ofd, unsigned int what) {
+static int dev_rate_ctr_timerfd_cb(struct osmo_fd *ofd, unsigned int what) {
 	size_t chan;
 	struct rate_ctr *ctr;
-	LOGC(DMAIN, NOTICE) << "Main thread is updating counters";
-	rate_ctr_mutex.lock();
+	LOGC(DCTR, INFO) << "Main thread is updating Device counters";
+	dev_rate_ctr_mutex.lock();
 	for (chan = 0; chan < chan_len; chan++) {
-		if (ctrs_pending[chan].chan == PENDING_CHAN_NONE)
+		if (dev_ctrs_pending[chan].chan == PENDING_CHAN_NONE)
 			continue;
-		LOGCHAN(chan, DMAIN, INFO) << "rate_ctr update";
-		ctr = &rate_ctrs[chan]->ctr[TRX_CTR_RX_OVERRUNS];
-		rate_ctr_add(ctr, ctrs_pending[chan].rx_overruns - ctr->current);
-		ctr = &rate_ctrs[chan]->ctr[TRX_CTR_TX_UNDERRUNS];
-		rate_ctr_add(ctr, ctrs_pending[chan].tx_underruns - ctr->current);
-		ctr = &rate_ctrs[chan]->ctr[TRX_CTR_RX_DROP_EV];
-		rate_ctr_add(ctr, ctrs_pending[chan].rx_dropped_events - ctr->current);
-		ctr = &rate_ctrs[chan]->ctr[TRX_CTR_RX_DROP_SMPL];
-		rate_ctr_add(ctr, ctrs_pending[chan].rx_dropped_samples - ctr->current);
-		ctr = &rate_ctrs[chan]->ctr[TRX_CTR_TX_DROP_EV];
-		rate_ctr_add(ctr, ctrs_pending[chan].tx_dropped_events - ctr->current);
-		ctr = &rate_ctrs[chan]->ctr[TRX_CTR_TX_DROP_SMPL];
-		rate_ctr_add(ctr, ctrs_pending[chan].tx_dropped_samples - ctr->current);
+		LOGCHAN(chan, DCTR, DEBUG) << "rate_ctr update";
+		ctr = rate_ctr_group_get_ctr(rate_ctrs[chan], TRX_CTR_DEV_RX_OVERRUNS);
+		rate_ctr_add(ctr, dev_ctrs_pending[chan].rx_overruns - ctr->current);
+		ctr = rate_ctr_group_get_ctr(rate_ctrs[chan], TRX_CTR_DEV_TX_UNDERRUNS);
+		rate_ctr_add(ctr, dev_ctrs_pending[chan].tx_underruns - ctr->current);
+		ctr = rate_ctr_group_get_ctr(rate_ctrs[chan], TRX_CTR_DEV_RX_DROP_EV);
+		rate_ctr_add(ctr, dev_ctrs_pending[chan].rx_dropped_events - ctr->current);
+		ctr = rate_ctr_group_get_ctr(rate_ctrs[chan], TRX_CTR_DEV_RX_DROP_SMPL);
+		rate_ctr_add(ctr, dev_ctrs_pending[chan].rx_dropped_samples - ctr->current);
+		ctr = rate_ctr_group_get_ctr(rate_ctrs[chan], TRX_CTR_DEV_TX_DROP_EV);
+		rate_ctr_add(ctr, dev_ctrs_pending[chan].tx_dropped_events - ctr->current);
+		ctr = rate_ctr_group_get_ctr(rate_ctrs[chan], TRX_CTR_DEV_TX_DROP_SMPL);
+		rate_ctr_add(ctr, dev_ctrs_pending[chan].tx_dropped_samples - ctr->current);

 		/* Mark as done */
-		ctrs_pending[chan].chan = PENDING_CHAN_NONE;
+		dev_ctrs_pending[chan].chan = PENDING_CHAN_NONE;
 	}
-	if (osmo_timerfd_disable(&rate_ctr_timerfd) < 0)
-		LOGC(DMAIN, ERROR) << "Failed to disable timerfd";
-	rate_ctr_mutex.unlock();
+	if (osmo_timerfd_disable(&dev_rate_ctr_timerfd) < 0)
+		LOGC(DCTR, ERROR) << "Failed to disable timerfd";
+	dev_rate_ctr_mutex.unlock();
+	return 0;
+}
+
+static int trx_rate_ctr_timerfd_cb(struct osmo_fd *ofd, unsigned int what) {
+	size_t chan;
+	struct rate_ctr *ctr;
+	LOGC(DCTR, INFO) << "Main thread is updating Transceiver counters";
+	trx_rate_ctr_mutex.lock();
+	for (chan = 0; chan < chan_len; chan++) {
+		if (trx_ctrs_pending[chan].chan == PENDING_CHAN_NONE)
+			continue;
+		LOGCHAN(chan, DCTR, DEBUG) << "rate_ctr update";
+		ctr = rate_ctr_group_get_ctr(rate_ctrs[chan], TRX_CTR_TRX_TX_STALE_BURSTS);
+		rate_ctr_add(ctr, trx_ctrs_pending[chan].tx_stale_bursts - ctr->current);
+		ctr = rate_ctr_group_get_ctr(rate_ctrs[chan], TRX_CTR_TRX_TX_UNAVAILABLE_BURSTS);
+		rate_ctr_add(ctr, trx_ctrs_pending[chan].tx_unavailable_bursts - ctr->current);
+		ctr = rate_ctr_group_get_ctr(rate_ctrs[chan], TRX_CTR_TRX_TRXD_FN_REPEATED);
+		rate_ctr_add(ctr, trx_ctrs_pending[chan].tx_trxd_fn_repeated - ctr->current);
+		ctr = rate_ctr_group_get_ctr(rate_ctrs[chan], TRX_CTR_TRX_TRXD_FN_OUTOFORDER);
+		rate_ctr_add(ctr, trx_ctrs_pending[chan].tx_trxd_fn_outoforder - ctr->current);
+		ctr = rate_ctr_group_get_ctr(rate_ctrs[chan], TRX_CTR_TRX_TRXD_FN_SKIPPED);
+		rate_ctr_add(ctr, trx_ctrs_pending[chan].tx_trxd_fn_skipped - ctr->current);
+		ctr = rate_ctr_group_get_ctr(rate_ctrs[chan], TRX_CTR_TRX_RX_EMPTY_BURST);
+		rate_ctr_add(ctr, trx_ctrs_pending[chan].rx_empty_burst - ctr->current);
+		ctr = rate_ctr_group_get_ctr(rate_ctrs[chan], TRX_CTR_TRX_RX_CLIPPING);
+		rate_ctr_add(ctr, trx_ctrs_pending[chan].rx_clipping - ctr->current);
+		ctr = rate_ctr_group_get_ctr(rate_ctrs[chan], TRX_CTR_TRX_RX_NO_BURST_DETECTED);
+		rate_ctr_add(ctr, trx_ctrs_pending[chan].rx_no_burst_detected - ctr->current);
+		/* Mark as done */
+		trx_ctrs_pending[chan].chan = PENDING_CHAN_NONE;
+	}
+	if (osmo_timerfd_disable(&trx_rate_ctr_timerfd) < 0)
+		LOGC(DCTR, ERROR) << "Failed to disable timerfd";
+	trx_rate_ctr_mutex.unlock();
 	return 0;
 }

@@ -154,23 +207,37 @@ static int rate_ctr_timerfd_cb(struct osmo_fd *ofd, unsigned int what) {
 static int device_sig_cb(unsigned int subsys, unsigned int signal,
 			 void *handler_data, void *signal_data)
 {
-	struct device_counters *ctr;
+	struct device_counters *dev_ctr;
+	struct trx_counters *trx_ctr;
 	/* Delay sched around 20 ms, in case we receive several calls from several
 	 * channels batched */
 	struct timespec next_sched = {.tv_sec = 0, .tv_nsec = 20*1000*1000};
 	/* no automatic re-trigger */
 	struct timespec intv_sched = {.tv_sec = 0, .tv_nsec = 0};
+	char err_buf[256];

 	switch (signal) {
 	case S_DEVICE_COUNTER_CHANGE:
-		ctr = (struct device_counters *)signal_data;
-		LOGCHAN(ctr->chan, DMAIN, NOTICE) << "Received counter change from radioDevice";
-		rate_ctr_mutex.lock();
-		ctrs_pending[ctr->chan] = *ctr;
-		if (osmo_timerfd_schedule(&rate_ctr_timerfd, &next_sched, &intv_sched) < 0) {
-			LOGC(DMAIN, ERROR) << "Failed to schedule timerfd: " << errno << " = "<< strerror(errno);
+		dev_ctr = (struct device_counters *)signal_data;
+		LOGCHAN(dev_ctr->chan, DCTR, INFO) << "Received counter change from radioDevice";
+		dev_rate_ctr_mutex.lock();
+		dev_ctrs_pending[dev_ctr->chan] = *dev_ctr;
+		if (osmo_timerfd_schedule(&dev_rate_ctr_timerfd, &next_sched, &intv_sched) < 0) {
+			LOGC(DCTR, ERROR) << "Failed to schedule timerfd: " << errno
+					  << " = "<< strerror_r(errno, err_buf, sizeof(err_buf));
 		}
-		rate_ctr_mutex.unlock();
+		dev_rate_ctr_mutex.unlock();
+		break;
+	case S_TRX_COUNTER_CHANGE:
+		trx_ctr = (struct trx_counters *)signal_data;
+		LOGCHAN(trx_ctr->chan, DCTR, INFO) << "Received counter change from Transceiver";
+		trx_rate_ctr_mutex.lock();
+		trx_ctrs_pending[trx_ctr->chan] = *trx_ctr;
+		if (osmo_timerfd_schedule(&trx_rate_ctr_timerfd, &next_sched, &intv_sched) < 0) {
+			LOGC(DCTR, ERROR) << "Failed to schedule timerfd: " << errno
+					  << " = "<< strerror_r(errno, err_buf, sizeof(err_buf));
+		}
+		trx_rate_ctr_mutex.unlock();
 		break;
 	default:
 		break;
@@ -195,15 +262,15 @@ static void threshold_timer_cb(void *data)
 	struct ctr_threshold *ctr_thr;
 	struct rate_ctr *rate_ctr;
 	size_t chan;
-	LOGC(DMAIN, DEBUG) << "threshold_timer_cb fired!";
+	LOGC(DCTR, DEBUG) << "threshold_timer_cb fired!";

 	llist_for_each_entry(ctr_thr, &threshold_list, list) {
 		for (chan = 0; chan < chan_len; chan++) {
-			rate_ctr = &rate_ctrs[chan]->ctr[ctr_thr->ctr_id];
-			LOGCHAN(chan, DMAIN, INFO) << "checking threshold: " << ctr_threshold_2_vty_str(ctr_thr)
+			rate_ctr = rate_ctr_group_get_ctr(rate_ctrs[chan], ctr_thr->ctr_id);
+			LOGCHAN(chan, DCTR, INFO) << "checking threshold: " << ctr_threshold_2_vty_str(ctr_thr)
 						   << " ("<< rate_ctr->intv[ctr_thr->intv].rate << " vs " << ctr_thr->val << ")";
 			if (rate_ctr->intv[ctr_thr->intv].rate >= ctr_thr->val) {
-				LOGCHAN(chan, DMAIN, FATAL) << "threshold reached, stopping! " << ctr_threshold_2_vty_str(ctr_thr)
+				LOGCHAN(chan, DCTR, FATAL) << "threshold reached, stopping! " << ctr_threshold_2_vty_str(ctr_thr)
 							   << " ("<< rate_ctr->intv[ctr_thr->intv].rate << " vs " << ctr_thr->val << ")";
 				osmo_signal_dispatch(SS_MAIN, S_MAIN_STOP_REQUIRED, NULL);
 				return;
@@ -245,8 +312,7 @@ static void threshold_timer_update_intv() {
 		return;

 	if (llist_empty(&threshold_list)) {
-		if (osmo_timer_pending(&threshold_timer))
-			osmo_timer_del(&threshold_timer);
+		osmo_timer_del(&threshold_timer);
 		return;
 	}

@@ -255,13 +321,13 @@ static void threshold_timer_update_intv() {

 	llist_for_each_entry(ctr, &threshold_list, list) {
 		secs = ctr_threshold_2_seconds(ctr);
-		if( min_secs > secs)
+		if (min_secs > secs)
 			min_secs = secs;
 	}


-	threshold_timer_sched_secs = OSMO_MAX(min_secs / 2 - 1, 1);
-	LOGC(DMAIN, INFO) << "New ctr-error-threshold check interval: "
+	threshold_timer_sched_secs = OSMO_MAX((int)(min_secs / 2 - 1), 1);
+	LOGC(DCTR, INFO) << "New ctr-error-threshold check interval: "
 			  << threshold_timer_sched_secs << " seconds";
 	osmo_timer_schedule(&threshold_timer, threshold_timer_sched_secs, 0);
 }
@@ -272,20 +338,27 @@ void trx_rate_ctr_init(void *ctx, struct trx_ctx* trx_ctx)
 	size_t  i;
 	trx_rate_ctr_ctx = ctx;
 	chan_len = trx_ctx->cfg.num_chans;
-	ctrs_pending = (struct device_counters*) talloc_zero_size(ctx, chan_len * sizeof(struct device_counters));
+	dev_ctrs_pending = (struct device_counters*) talloc_zero_size(ctx, chan_len * sizeof(struct device_counters));
+	trx_ctrs_pending = (struct trx_counters*) talloc_zero_size(ctx, chan_len * sizeof(struct trx_counters));
 	rate_ctrs = (struct rate_ctr_group**) talloc_zero_size(ctx, chan_len * sizeof(struct rate_ctr_group*));

 	for (i = 0; i < chan_len; i++) {
-		ctrs_pending[i].chan = PENDING_CHAN_NONE;
+		dev_ctrs_pending[i].chan = PENDING_CHAN_NONE;
+		trx_ctrs_pending[i].chan = PENDING_CHAN_NONE;
 		rate_ctrs[i] = rate_ctr_group_alloc(ctx, &trx_chan_ctr_group_desc, i);
 		if (!rate_ctrs[i]) {
-			LOGCHAN(i, DMAIN, ERROR) << "Failed to allocate rate ctr";
+			LOGCHAN(i, DCTR, ERROR) << "Failed to allocate rate ctr";
 			exit(1);
 		}
 	}
-	rate_ctr_timerfd.fd = -1;
-	if (osmo_timerfd_setup(&rate_ctr_timerfd, rate_ctr_timerfd_cb, NULL) < 0) {
-		LOGC(DMAIN, ERROR) << "Failed to setup timerfd";
+	dev_rate_ctr_timerfd.fd = -1;
+	if (osmo_timerfd_setup(&dev_rate_ctr_timerfd, dev_rate_ctr_timerfd_cb, NULL) < 0) {
+		LOGC(DCTR, ERROR) << "Failed to setup timerfd";
+		exit(1);
+	}
+	trx_rate_ctr_timerfd.fd = -1;
+	if (osmo_timerfd_setup(&trx_rate_ctr_timerfd, trx_rate_ctr_timerfd_cb, NULL) < 0) {
+		LOGC(DCTR, ERROR) << "Failed to setup timerfd";
 		exit(1);
 	}
 	osmo_signal_register_handler(SS_DEVICE, device_sig_cb, NULL);
@@ -302,7 +375,7 @@ void trx_rate_ctr_threshold_add(struct ctr_threshold *ctr)

 	new_ctr = talloc_zero(trx_rate_ctr_ctx, struct ctr_threshold);
 	*new_ctr = *ctr;
-	LOGC(DMAIN, NOTICE) << "Adding new threshold check: " << ctr_threshold_2_vty_str(new_ctr);
+	LOGC(DCTR, NOTICE) << "Adding new threshold check: " << ctr_threshold_2_vty_str(new_ctr);
 	llist_add(&new_ctr->list, &threshold_list);
 	threshold_timer_update_intv();
 }
@@ -317,7 +390,7 @@ int trx_rate_ctr_threshold_del(struct ctr_threshold *del_ctr)
 		    ctr->val != del_ctr->val)
 			continue;

-		LOGC(DMAIN, NOTICE) << "Deleting threshold check: " << ctr_threshold_2_vty_str(del_ctr);
+		LOGC(DCTR, NOTICE) << "Deleting threshold check: " << ctr_threshold_2_vty_str(del_ctr);
 		llist_del(&ctr->list);
 		talloc_free(ctr);
 		threshold_timer_update_intv();
--- a/CommonLibs/trx_rate_ctr.h
+++ b/CommonLibs/trx_rate_ctr.h
@@ -4,12 +4,20 @@
 #include <osmocom/vty/command.h>

 enum TrxCtr {
-	TRX_CTR_RX_OVERRUNS,
-	TRX_CTR_TX_UNDERRUNS,
-	TRX_CTR_RX_DROP_EV,
-	TRX_CTR_RX_DROP_SMPL,
-	TRX_CTR_TX_DROP_EV,
-	TRX_CTR_TX_DROP_SMPL,
+	TRX_CTR_DEV_RX_OVERRUNS,
+	TRX_CTR_DEV_TX_UNDERRUNS,
+	TRX_CTR_DEV_RX_DROP_EV,
+	TRX_CTR_DEV_RX_DROP_SMPL,
+	TRX_CTR_DEV_TX_DROP_EV,
+	TRX_CTR_DEV_TX_DROP_SMPL,
+	TRX_CTR_TRX_TX_STALE_BURSTS,
+	TRX_CTR_TRX_TX_UNAVAILABLE_BURSTS,
+	TRX_CTR_TRX_TRXD_FN_REPEATED,
+	TRX_CTR_TRX_TRXD_FN_OUTOFORDER,
+	TRX_CTR_TRX_TRXD_FN_SKIPPED,
+	TRX_CTR_TRX_RX_EMPTY_BURST,
+	TRX_CTR_TRX_RX_CLIPPING,
+	TRX_CTR_TRX_RX_NO_BURST_DETECTED,
 };

 struct ctr_threshold {
--- a/CommonLibs/trx_vty.c
+++ b/CommonLibs/trx_vty.c
@@ -67,6 +67,15 @@ static const struct value_string filler_types[] = {
 	{ 0,			NULL }
 };

+static const struct value_string filler_docs[] = {
+	{ FILLER_DUMMY,		"Send a Dummy Burst on C0 (TRX0) and empty burst on other channels" },
+	{ FILLER_ZERO,		"Send an empty burst (default)" },
+	{ FILLER_NORM_RAND,	"Send a GMSK modulated Normal Burst with random bits (spectrum mask testing)" },
+	{ FILLER_EDGE_RAND,	"Send an 8-PSK modulated Normal Burst with random bits (spectrum mask testing)" },
+	{ FILLER_ACCESS_RAND,	"Send an Access Burst with random bits (Rx/Tx alignment testing)" },
+	{ 0,			NULL }
+};
+

 struct trx_ctx *trx_from_vty(struct vty *v)
 {
@@ -112,7 +121,7 @@ DEFUN(cfg_trx, cfg_trx_cmd,
 }

 DEFUN(cfg_bind_ip, cfg_bind_ip_cmd,
-	"bind-ip A.B.C.D",
+	"bind-ip " VTY_IPV4_CMD,
 	"Set the IP address for the local bind\n"
 	"IPv4 Address\n")
 {
@@ -124,7 +133,7 @@ DEFUN(cfg_bind_ip, cfg_bind_ip_cmd,
 }

 DEFUN(cfg_remote_ip, cfg_remote_ip_cmd,
-	"remote-ip A.B.C.D",
+	"remote-ip " VTY_IPV4_CMD,
 	"Set the IP address for the remote BTS\n"
 	"IPv4 Address\n")
 {
@@ -162,7 +171,9 @@ DEFUN(cfg_dev_args, cfg_dev_args_cmd,
 DEFUN(cfg_tx_sps, cfg_tx_sps_cmd,
 	"tx-sps (1|4)",
 	"Set the Tx Samples-per-Symbol\n"
-	"Tx Samples-per-Symbol\n")
+	"Tx Samples-per-Symbol\n"
+	"1 Sample-per-Symbol\n"
+	"4 Samples-per-Symbol\n")
 {
 	struct trx_ctx *trx = trx_from_vty(vty);

@@ -174,7 +185,9 @@ DEFUN(cfg_tx_sps, cfg_tx_sps_cmd,
 DEFUN(cfg_rx_sps, cfg_rx_sps_cmd,
 	"rx-sps (1|4)",
 	"Set the Rx Samples-per-Symbol\n"
-	"Rx Samples-per-Symbol\n")
+	"Rx Samples-per-Symbol\n"
+	"1 Sample-per-Symbol\n"
+	"4 Samples-per-Symbol\n")
 {
 	struct trx_ctx *trx = trx_from_vty(vty);

@@ -199,7 +212,8 @@ DEFUN(cfg_clock_ref, cfg_clock_ref_cmd,

 DEFUN(cfg_multi_arfcn, cfg_multi_arfcn_cmd,
 	"multi-arfcn (disable|enable)",
-	"Enable multi-ARFCN transceiver (default=disable)\n")
+	"Multi-ARFCN transceiver mode (default=disable)\n"
+	"Enable multi-ARFCN mode\n" "Disable multi-ARFCN mode\n")
 {
 	struct trx_ctx *trx = trx_from_vty(vty);

@@ -230,21 +244,125 @@ DEFUN(cfg_offset, cfg_offset_cmd,
 	return CMD_SUCCESS;
 }

+DEFUN_ATTR(cfg_freq_offset, cfg_freq_offset_cmd,
+	   "freq-offset FLOAT",
+	   "Apply an artificial offset to Rx/Tx carrier frequency\n"
+	   "Frequency offset in kHz (e.g. -145300)\n",
+	   CMD_ATTR_HIDDEN)
+{
+	struct trx_ctx *trx = trx_from_vty(vty);
+
+	trx->cfg.freq_offset_khz = atof(argv[0]);
+
+	return CMD_SUCCESS;
+}
+
 DEFUN(cfg_rssi_offset, cfg_rssi_offset_cmd,
-	"rssi-offset FLOAT",
+	"rssi-offset FLOAT [relative]",
 	"Set the RSSI to dBm offset in dB (default=0)\n"
-	"RSSI to dBm offset in dB\n")
+	"RSSI to dBm offset in dB\n"
+	"Add to the default rssi-offset value instead of completely replacing it\n")
 {
 	struct trx_ctx *trx = trx_from_vty(vty);

 	trx->cfg.rssi_offset = atof(argv[0]);
+	trx->cfg.force_rssi_offset = (argc == 1);
+
+	return CMD_SUCCESS;
+}
+
+
+DEFUN_ATTR(cfg_ul_fn_offset, cfg_ul_fn_offset_cmd,
+	"ul-fn-offset <-10-10>",
+	"Adjusts the uplink frame FN by the specified amount\n"
+	"Frame Number offset\n",
+	CMD_ATTR_HIDDEN)
+{
+	struct trx_ctx *trx = trx_from_vty(vty);
+
+	trx->cfg.ul_fn_offset = atoi(argv[0]);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN_ATTR(cfg_ul_freq_override, cfg_ul_freq_override_cmd,
+	   "ul-freq-override FLOAT",
+	   "Overrides Rx carrier frequency\n"
+	   "Frequency in Hz (e.g. 145300000)\n",
+	   CMD_ATTR_HIDDEN)
+{
+	struct trx_ctx *trx = trx_from_vty(vty);
+
+	trx->cfg.overrides.ul_freq_override = true;
+	trx->cfg.overrides.ul_freq = atof(argv[0]);
+
+	return CMD_SUCCESS;
+}
+DEFUN_ATTR(cfg_dl_freq_override, cfg_dl_freq_override_cmd,
+	   "dl-freq-override FLOAT",
+	   "Overrides Tx carrier frequency\n"
+	   "Frequency in Hz (e.g. 145300000)\n",
+	   CMD_ATTR_HIDDEN)
+{
+	struct trx_ctx *trx = trx_from_vty(vty);
+
+	trx->cfg.overrides.dl_freq_override = true;
+	trx->cfg.overrides.dl_freq = atof(argv[0]);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN_ATTR(cfg_ul_gain_override, cfg_ul_gain_override_cmd,
+	   "ul-gain-override FLOAT",
+	   "Overrides Rx gain\n"
+	   "gain in dB\n",
+	   CMD_ATTR_HIDDEN)
+{
+	struct trx_ctx *trx = trx_from_vty(vty);
+
+	trx->cfg.overrides.ul_gain_override = true;
+	trx->cfg.overrides.ul_gain = atof(argv[0]);
+
+	return CMD_SUCCESS;
+}
+DEFUN_ATTR(cfg_dl_gain_override, cfg_dl_gain_override_cmd,
+	   "dl-gain-override FLOAT",
+	   "Overrides Tx gain\n"
+	   "gain in dB\n",
+	   CMD_ATTR_HIDDEN)
+{
+	struct trx_ctx *trx = trx_from_vty(vty);
+
+	trx->cfg.overrides.dl_gain_override = true;
+	trx->cfg.overrides.dl_gain = atof(argv[0]);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN_ATTR(cfg_use_viterbi, cfg_use_viterbi_cmd,
+	"viterbi-eq (disable|enable)",
+	"Use viterbi equalizer for gmsk (default=disable)\n"
+	"Disable VA\n"
+	"Enable VA\n",
+	CMD_ATTR_HIDDEN)
+{
+	struct trx_ctx *trx = trx_from_vty(vty);
+
+	if (strcmp("disable", argv[0]) == 0)
+		trx->cfg.use_va = false;
+	else if (strcmp("enable", argv[0]) == 0)
+		trx->cfg.use_va = true;
+	else
+		return CMD_WARNING;

 	return CMD_SUCCESS;
 }

 DEFUN(cfg_swap_channels, cfg_swap_channels_cmd,
 	"swap-channels (disable|enable)",
-	"Swap channels (default=disable)\n")
+	"Swap primary and secondary channels of the PHY (if any)\n"
+	"Do not swap primary and secondary channels (default)\n"
+	"Swap primary and secondary channels\n")
 {
 	struct trx_ctx *trx = trx_from_vty(vty);

@@ -261,7 +379,9 @@ DEFUN(cfg_swap_channels, cfg_swap_channels_cmd,

 DEFUN(cfg_egprs, cfg_egprs_cmd,
 	"egprs (disable|enable)",
-	"Enable EDGE receiver (default=disable)\n")
+	"EGPRS (8-PSK demodulation) support (default=disable)\n"
+	"Disable EGPRS (8-PSK demodulation) support\n"
+	"Enable EGPRS (8-PSK demodulation) support\n")
 {
 	struct trx_ctx *trx = trx_from_vty(vty);

@@ -278,7 +398,9 @@ DEFUN(cfg_egprs, cfg_egprs_cmd,

 DEFUN(cfg_ext_rach, cfg_ext_rach_cmd,
 	"ext-rach (disable|enable)",
-	"Enable extended (11-bit) RACH (default=disable)\n")
+	"11-bit Access Burst correlation support (default=disable)\n"
+	"Disable 11-bit Access Burst (TS1 & TS2) correlation\n"
+	"Enable 11-bit Access Burst (TS1 & TS2) correlation\n")
 {
 	struct trx_ctx *trx = trx_from_vty(vty);

@@ -291,7 +413,7 @@ DEFUN(cfg_ext_rach, cfg_ext_rach_cmd,
 	return CMD_SUCCESS;
 }

-DEFUN(cfg_rt_prio, cfg_rt_prio_cmd,
+DEFUN_DEPRECATED(cfg_rt_prio, cfg_rt_prio_cmd,
 	"rt-prio <1-32>",
 	"Set the SCHED_RR real-time priority\n"
 	"Real time priority\n")
@@ -299,6 +421,8 @@ DEFUN(cfg_rt_prio, cfg_rt_prio_cmd,
 	struct trx_ctx *trx = trx_from_vty(vty);

 	trx->cfg.sched_rr = atoi(argv[0]);
+	vty_out (vty, "%% 'rt-prio %u' is deprecated, use 'policy rr %u' under 'sched' node instead%s",
+		 trx->cfg.sched_rr, trx->cfg.sched_rr, VTY_NEWLINE);

 	return CMD_SUCCESS;
 }
@@ -315,20 +439,11 @@ DEFUN(cfg_stack_size, cfg_stack_size_cmd,
 	return CMD_SUCCESS;
 }

-DEFUN(cfg_filler, cfg_filler_type_cmd,
-	"filler type (zero|dummy|random-nb-gmsk|random-nb-8psk|random-ab)",
+#define CFG_FILLER_DOC_STR \
 	"Filler burst settings\n"
-	"Filler burst type (default=zero)\n"
-	"Send an empty burst when there is nothing to send (default)\n"
-	"Send a dummy burst when there is nothing to send on C0 (TRX0) and empty burst on other channels."
-	" Use for OpenBTS compatibility only, don't use with OsmoBTS as it breaks encryption.\n"
-	"Send a GMSK modulated Normal Burst with random bits when there is nothing to send."
-	" Use for spectrum mask testing. Configure 'filler tsc' to set training sequence.\n"
-	"Send an 8-PSK modulated Normal Burst with random bits when there is nothing to send."
-	" Use for spectrum mask testing. Configure 'filler tsc' to set training sequence.\n"
-	"Send an Access Burst with random bits when there is nothing to send. Use for Rx/Tx alignment."
-	" Configure 'filler access-burst-delay' to introduce artificial delay.\n"
-)
+
+DEFUN(cfg_filler, cfg_filler_type_cmd,
+      "AUTO-GENERATED", "AUTO-GENERATED")
 {
 	struct trx_ctx *trx = trx_from_vty(vty);
 	// trx->cfg.filler is unsigned, so we need an interim int var to detect errors
@@ -345,7 +460,7 @@ DEFUN(cfg_filler, cfg_filler_type_cmd,

 DEFUN(cfg_test_rtsc, cfg_filler_tsc_cmd,
 	"filler tsc <0-7>",
-	"Filler burst settings\n"
+	CFG_FILLER_DOC_STR
 	"Set the TSC for GMSK/8-PSK Normal Burst random fillers. Used only with 'random-nb-gmsk' and"
 	" 'random-nb-8psk' filler types. (default=0)\n"
 	"TSC\n")
@@ -359,7 +474,7 @@ DEFUN(cfg_test_rtsc, cfg_filler_tsc_cmd,

 DEFUN(cfg_test_rach_delay, cfg_filler_rach_delay_cmd,
 	"filler access-burst-delay <0-68>",
-	"Filler burst settings\n"
+	CFG_FILLER_DOC_STR
 	"Set the delay for Access Burst random fillers. Used only with 'random-ab' filler type. (default=0)\n"
 	"RACH delay in symbols\n")
 {
@@ -390,7 +505,7 @@ static int vty_intv_name_2_id(const char* str) {
 	return -1;
 }

-#define THRESHOLD_ARGS "(rx_overruns|tx_underruns|rx_drop_events|rx_drop_samples|tx_drop_events|tx_drop_samples)"
+#define THRESHOLD_ARGS "(rx_overruns|tx_underruns|rx_drop_events|rx_drop_samples|tx_drop_events|tx_drop_samples|tx_stale_bursts|tx_unavailable_bursts|tx_trxd_fn_repeated|tx_trxd_fn_outoforder|tx_trxd_fn_skipped)"
 #define THRESHOLD_STR_VAL(s) "Set threshold value for rate_ctr device:" OSMO_STRINGIFY_VAL(s) "\n"
 #define THRESHOLD_STRS \
 	THRESHOLD_STR_VAL(rx_overruns) \
@@ -398,7 +513,13 @@ static int vty_intv_name_2_id(const char* str) {
 	THRESHOLD_STR_VAL(rx_drop_events) \
 	THRESHOLD_STR_VAL(rx_drop_samples) \
 	THRESHOLD_STR_VAL(tx_drop_events) \
-	THRESHOLD_STR_VAL(tx_drop_samples)
+	THRESHOLD_STR_VAL(tx_drop_samples) \
+	THRESHOLD_STR_VAL(tx_stale_bursts) \
+	THRESHOLD_STR_VAL(tx_unavailable_bursts) \
+	THRESHOLD_STR_VAL(tx_trxd_fn_repeated) \
+	THRESHOLD_STR_VAL(tx_trxd_fn_outoforder) \
+	THRESHOLD_STR_VAL(tx_trxd_fn_skipped) \
+	""
 #define INTV_ARGS "(per-second|per-minute|per-hour|per-day)"
 #define INTV_STR_VAL(s) "Threshold value sampled " OSMO_STRINGIFY_VAL(s) "\n"
 #define INTV_STRS \
@@ -407,17 +528,17 @@ static int vty_intv_name_2_id(const char* str) {
 	INTV_STR_VAL(per-hour) \
 	INTV_STR_VAL(per-day)

-DEFUN(cfg_ctr_error_threshold, cfg_ctr_error_threshold_cmd,
-	"ctr-error-threshold " THRESHOLD_ARGS " <0-65535> " INTV_ARGS,
-	"Threshold rate for error counter\n"
-	THRESHOLD_STRS
-	"Value to set for threshold\n"
-	INTV_STRS)
+DEFUN_ATTR(cfg_ctr_error_threshold, cfg_ctr_error_threshold_cmd,
+	   "ctr-error-threshold " THRESHOLD_ARGS " <0-65535> " INTV_ARGS,
+	   "Threshold rate for error counter\n"
+	   THRESHOLD_STRS
+	   "Value to set for threshold\n"
+	   INTV_STRS,
+	   CMD_ATTR_IMMEDIATE)
 {
 	int rc;
 	struct ctr_threshold ctr;

-	struct trx_ctx *trx = trx_from_vty(vty);
 	rc = vty_ctr_name_2_id(argv[0]);
 	if (rc < 0) {
 		vty_out(vty, "No valid ctr_name found for ctr-error-threshold %s%s",
@@ -438,17 +559,17 @@ DEFUN(cfg_ctr_error_threshold, cfg_ctr_error_threshold_cmd,
 	return CMD_SUCCESS;
 }

-DEFUN(cfg_no_ctr_error_threshold, cfg_no_ctr_error_threshold_cmd,
-	"no ctr-error-threshold " THRESHOLD_ARGS " <0-65535> " INTV_ARGS,
-	NO_STR "Threshold rate for error counter\n"
-	THRESHOLD_STRS
-	"Value to set for threshold\n"
-	INTV_STRS)
+DEFUN_ATTR(cfg_no_ctr_error_threshold, cfg_no_ctr_error_threshold_cmd,
+	   "no ctr-error-threshold " THRESHOLD_ARGS " <0-65535> " INTV_ARGS,
+	   NO_STR "Threshold rate for error counter\n"
+	   THRESHOLD_STRS
+	   "Value to set for threshold\n"
+	   INTV_STRS,
+	   CMD_ATTR_IMMEDIATE)
 {
 	int rc;
 	struct ctr_threshold ctr;

-	struct trx_ctx *trx = trx_from_vty(vty);
 	rc = vty_ctr_name_2_id(argv[0]);
 	if (rc < 0) {
 		vty_out(vty, "No valid ctr_name found for ctr-error-threshold %s%s",
@@ -512,6 +633,12 @@ DEFUN(cfg_chan_rx_path, cfg_chan_rx_path_cmd,
 {
 	struct trx_chan *chan = vty->index;

+	if (chan->trx->cfg.multi_arfcn && chan->idx > 0) {
+		vty_out(vty, "%% Setting 'rx-path' for chan %u in multi-ARFCN mode "
+			     "does not make sense, because only chan 0 is used%s",
+			chan->idx, VTY_NEWLINE);
+	}
+
 	osmo_talloc_replace_string(chan->trx, &chan->rx_path, argv[0]);

 	return CMD_SUCCESS;
@@ -524,6 +651,12 @@ DEFUN(cfg_chan_tx_path, cfg_chan_tx_path_cmd,
 {
 	struct trx_chan *chan = vty->index;

+	if (chan->trx->cfg.multi_arfcn && chan->idx > 0) {
+		vty_out(vty, "%% Setting 'tx-path' for chan %u in multi-ARFCN mode "
+			     "does not make sense, because only chan 0 is used%s",
+			chan->idx, VTY_NEWLINE);
+	}
+
 	osmo_talloc_replace_string(chan->trx, &chan->tx_path, argv[0]);

 	return CMD_SUCCESS;
@@ -547,7 +680,7 @@ static int config_write_trx(struct vty *vty)
 		vty_out(vty, " remote-ip %s%s", trx->cfg.remote_addr, VTY_NEWLINE);
 	if (trx->cfg.base_port != DEFAULT_TRX_PORT)
 		vty_out(vty, " base-port %u%s", trx->cfg.base_port, VTY_NEWLINE);
-	if (trx->cfg.dev_args)
+	if (strlen(trx->cfg.dev_args))
 		vty_out(vty, " dev-args %s%s", trx->cfg.dev_args, VTY_NEWLINE);
 	if (trx->cfg.tx_sps != DEFAULT_TX_SPS)
 		vty_out(vty, " tx-sps %u%s", trx->cfg.tx_sps, VTY_NEWLINE);
@@ -558,8 +691,11 @@ static int config_write_trx(struct vty *vty)
 	vty_out(vty, " multi-arfcn %s%s", trx->cfg.multi_arfcn ? "enable" : "disable", VTY_NEWLINE);
 	if (trx->cfg.offset != 0)
 		vty_out(vty, " offset %f%s", trx->cfg.offset, VTY_NEWLINE);
-	if (trx->cfg.rssi_offset != 0)
-		vty_out(vty, " rssi-offset %f%s", trx->cfg.rssi_offset, VTY_NEWLINE);
+	if (trx->cfg.freq_offset_khz != 0)
+		vty_out(vty, " freq-offset %f%s", trx->cfg.freq_offset_khz, VTY_NEWLINE);
+	if (!(trx->cfg.rssi_offset == 0 && !trx->cfg.force_rssi_offset))
+		vty_out(vty, " rssi-offset %f%s%s", trx->cfg.rssi_offset,
+			trx->cfg.force_rssi_offset ? " relative": "", VTY_NEWLINE);
 	vty_out(vty, " swap-channels %s%s", trx->cfg.swap_channels ? "enable" : "disable", VTY_NEWLINE);
 	vty_out(vty, " egprs %s%s", trx->cfg.egprs ? "enable" : "disable", VTY_NEWLINE);
 	vty_out(vty, " ext-rach %s%s", trx->cfg.ext_rach ? "enable" : "disable", VTY_NEWLINE);
@@ -573,6 +709,18 @@ static int config_write_trx(struct vty *vty)
 		vty_out(vty, " filler access-burst-delay %u%s", trx->cfg.rach_delay, VTY_NEWLINE);
 	if (trx->cfg.stack_size != 0)
 		vty_out(vty, " stack-size %u%s", trx->cfg.stack_size, VTY_NEWLINE);
+	if (trx->cfg.ul_fn_offset != 0)
+		vty_out(vty, " ul-fn-offset %d%s", trx->cfg.ul_fn_offset, VTY_NEWLINE);
+	if (trx->cfg.overrides.dl_freq_override)
+		vty_out(vty, " dl-freq-override %f%s", trx->cfg.overrides.dl_freq, VTY_NEWLINE);
+	if (trx->cfg.overrides.ul_freq_override)
+		vty_out(vty, " ul-freq-override %f%s", trx->cfg.overrides.ul_freq, VTY_NEWLINE);
+	if (trx->cfg.overrides.dl_gain_override)
+		vty_out(vty, " dl-gain-override %f%s", trx->cfg.overrides.dl_gain, VTY_NEWLINE);
+	if (trx->cfg.overrides.ul_gain_override)
+		vty_out(vty, " ul-gain-override %f%s", trx->cfg.overrides.ul_gain, VTY_NEWLINE);
+	if (trx->cfg.use_va)
+		vty_out(vty, " viterbi-eq %s%s", trx->cfg.use_va ? "enable" : "disable", VTY_NEWLINE);
 	trx_rate_ctr_threshold_write_config(vty, " ");

 	for (i = 0; i < trx->cfg.num_chans; i++) {
@@ -694,12 +842,20 @@ struct trx_ctx *vty_trx_ctx_alloc(void *talloc_ctx)
 	trx->cfg.tx_sps = DEFAULT_TX_SPS;
 	trx->cfg.rx_sps = DEFAULT_RX_SPS;
 	trx->cfg.filler = FILLER_ZERO;
+	trx->cfg.rssi_offset = 0.0f;
+	trx->cfg.dev_args = talloc_strdup(trx, "");

 	return trx;
 }

 int trx_vty_init(struct trx_ctx* trx)
 {
+	cfg_filler_type_cmd.string = vty_cmd_string_from_valstr(trx, filler_types,
+		"filler type (", "|", ")", 0);
+	cfg_filler_type_cmd.doc = vty_cmd_string_from_valstr(trx, filler_docs,
+		CFG_FILLER_DOC_STR "What to do when there is nothing to send "
+		"(filler type, default=zero)\n", "\n", "", 0);
+
 	g_trx_ctx = trx;
 	install_element_ve(&show_trx_cmd);

@@ -715,6 +871,7 @@ int trx_vty_init(struct trx_ctx* trx)
 	install_element(TRX_NODE, &cfg_clock_ref_cmd);
 	install_element(TRX_NODE, &cfg_multi_arfcn_cmd);
 	install_element(TRX_NODE, &cfg_offset_cmd);
+	install_element(TRX_NODE, &cfg_freq_offset_cmd);
 	install_element(TRX_NODE, &cfg_rssi_offset_cmd);
 	install_element(TRX_NODE, &cfg_swap_channels_cmd);
 	install_element(TRX_NODE, &cfg_egprs_cmd);
@@ -728,6 +885,12 @@ int trx_vty_init(struct trx_ctx* trx)
 	install_element(TRX_NODE, &cfg_stack_size_cmd);

 	install_element(TRX_NODE, &cfg_chan_cmd);
+	install_element(TRX_NODE, &cfg_ul_fn_offset_cmd);
+	install_element(TRX_NODE, &cfg_ul_freq_override_cmd);
+	install_element(TRX_NODE, &cfg_dl_freq_override_cmd);
+	install_element(TRX_NODE, &cfg_ul_gain_override_cmd);
+	install_element(TRX_NODE, &cfg_dl_gain_override_cmd);
+	install_element(TRX_NODE, &cfg_use_viterbi_cmd);
 	install_node(&chan_node, dummy_config_write);
 	install_element(CHAN_NODE, &cfg_chan_rx_path_cmd);
 	install_element(CHAN_NODE, &cfg_chan_tx_path_cmd);
--- a/CommonLibs/trx_vty.h
+++ b/CommonLibs/trx_vty.h
@@ -8,8 +8,6 @@ extern struct vty_app_info g_vty_info;
 extern const struct value_string clock_ref_names[];
 extern const struct value_string filler_names[];

-/* Maximum number of physical RF channels */
-#define TRX_CHAN_MAX 8
 /* Maximum number of carriers in multi-ARFCN mode */
 #define TRX_MCHAN_MAX 3

@@ -35,38 +33,8 @@ extern const struct value_string filler_names[];
 #define DEFAULT_TRX_IP		"127.0.0.1"
 #define DEFAULT_CHANS		1

-struct trx_ctx;
-
-struct trx_chan {
-	struct trx_ctx *trx; /* backpointer */
-	unsigned int idx; /* channel index */
-	char *rx_path;
-	char *tx_path;
-};
-
 struct trx_ctx {
-	struct {
-		char *bind_addr;
-		char *remote_addr;
-		char *dev_args;
-		unsigned int base_port;
-		unsigned int tx_sps;
-		unsigned int rx_sps;
-		unsigned int rtsc;
-		unsigned int rach_delay;
-		enum ReferenceType clock_ref;
-		enum FillerType filler;
-		bool multi_arfcn;
-		double offset;
-		double rssi_offset;
-		bool swap_channels;
-		bool ext_rach;
-		bool egprs;
-		unsigned int sched_rr;
-		unsigned int stack_size;
-		unsigned int num_chans;
-		struct trx_chan chans[TRX_CHAN_MAX];
-	} cfg;
+	struct trx_cfg cfg;
 };

 int trx_vty_init(struct trx_ctx* trx);
--- a/GSM/GSMCommon.cpp
+++ b/GSM/GSMCommon.cpp
@@ -55,12 +55,15 @@ const BitVector GSM::gEdgeTrainingSequence[] = {
 };

 const BitVector GSM::gDummyBurst("0001111101101110110000010100100111000001001000100000001111100011100010111000101110001010111010010100011001100111001111010011111000100101111101010000");
+const BitVector GSM::gDummyBurstTSC("01110001011100010111000101");

 /* 3GPP TS 05.02, section 5.2.7 "Access burst (AB)", synch. sequence bits */
 const BitVector GSM::gRACHSynchSequenceTS0("01001011011111111001100110101010001111000");  /* GSM, GMSK (default) */
 const BitVector GSM::gRACHSynchSequenceTS1("01010100111110001000011000101111001001101");  /* EGPRS, 8-PSK */
 const BitVector GSM::gRACHSynchSequenceTS2("11101111001001110101011000001101101110111");  /* EGPRS, GMSK */

+const BitVector GSM::gSCHSynchSequence("1011100101100010000001000000111100101101010001010111011000011011");
+
 //                               |-head-||---------midamble----------------------||--------------data----------------||t|
 const BitVector GSM::gRACHBurst("0011101001001011011111111001100110101010001111000110111101111110000111001001010110011000");

--- a/GSM/GSMCommon.h
+++ b/GSM/GSMCommon.h
@@ -52,11 +52,16 @@ extern const BitVector gEdgeTrainingSequence[];

 /** C0T0 filler burst, GSM 05.02, 5.2.6 */
 extern const BitVector gDummyBurst;
+extern const BitVector gDummyBurstTSC;

 /** Random access burst synch. sequence */
 extern const BitVector gRACHSynchSequenceTS0;
 extern const BitVector gRACHSynchSequenceTS1;
 extern const BitVector gRACHSynchSequenceTS2;
+
+/** Synchronization burst sync sequence */
+extern const BitVector gSCHSynchSequence;
+
 /** Random access burst synch. sequence, GSM 05.02 5.2.7 */
 extern const BitVector gRACHBurst;

--- a/Makefile.am
+++ b/Makefile.am
@@ -26,19 +26,37 @@ AM_CXXFLAGS = -Wall -pthread
 #AM_CXXFLAGS = -Wall -O2 -NDEBUG -pthread
 #AM_CFLAGS = -Wall -O2 -NDEBUG -pthread

+SUBDIRS =
+
+if ENABLE_MS_TRX
+SUBDIRS += $(LIBTRXCON_DIR)
+endif
+
 # Order must be preserved
-SUBDIRS = \
-	doc \
+SUBDIRS += \
 	CommonLibs \
 	GSM \
 	Transceiver52M \
 	contrib \
-	tests
+	tests \
+	utils \
+	doc \
+	$(NULL)
+
+BUILT_SOURCES = $(top_srcdir)/.version
+$(top_srcdir)/.version:
+	echo $(VERSION) > $@-t && mv $@-t $@
+dist-hook:
+	echo $(VERSION) > $(distdir)/.tarball-version

 EXTRA_DIST = \
+	.version \
 	LEGAL \
 	COPYING \
-	README.md
+	README.md \
+	debian \
+	git-version-gen \
+	$(NULL)

 AM_DISTCHECK_CONFIGURE_FLAGS = \
 	--with-systemdsystemunitdir=$$dc_install_base/$(systemdsystemunitdir)
--- a/README.md
+++ b/README.md
@@ -1,22 +1,20 @@
-About OsmTRX
-============
+About OsmoTRX
+=============

 OsmoTRX is a software-defined radio transceiver that implements the Layer 1
 physical layer of a BTS comprising the following 3GPP specifications:

-* TS 05.01 "Physical layer on the radio path"
-* TS 05.02 "Multiplexing and Multiple Access on the Radio Path"
-* TS 05.04 "Modulation"
-* TS 05.10 "Radio subsystem synchronization"
+* TS 05.01 *Physical layer on the radio path*
+* TS 05.02 *Multiplexing and Multiple Access on the Radio Path*
+* TS 05.04 *Modulation*
+* TS 05.10 *Radio subsystem synchronization*

-OsmoTRX is based on the transceiver code from the
+OsmoTRX is originally based on the transceiver code from the
 [OpenBTS](https://osmocom.org/projects/osmobts/wiki/OpenBTS) project, but setup
 to operate independently with the purpose of using with non-OpenBTS software and
-projects, while still maintaining backwards compatibility with OpenBTS when
-possible. Currently there are numerous features contained in OsmoTRX that extend
-the functionality of the OpenBTS transceiver. These features include enhanced
-support for various embedded platforms - notably ARM - and dual channel
-diversity support for the Fairwaves umtrx.
+projects, specifically within the Osmocom stack.  Used together with
+[OsmoBTS](https://osmocom.org/projects/osmobts/wiki) you can get a pretty
+standard GSM/GPRS/EGPRS BTS with Abis interface as per the relevant 3GPP specifications.

 Homepage
 --------
@@ -29,9 +27,9 @@ GIT Repository

 You can clone from the official osmo-trx.git repository using

-        git clone git://git.osmocom.org/osmo-trx.git
+        git clone https://gitea.osmocom.org/cellular-infrastructure/osmo-trx

-There is a cgit interface at <http://git.osmocom.org/osmo-trx/>
+There is a web interface at <https://gitea.osmocom.org/cellular-infrastructure/osmo-trx>

 Documentation
 -------------
@@ -39,7 +37,14 @@ Documentation
 Doxygen-generated API documentation is generated during the build process, but
 also available online for each of the sub-libraries at User Manual for OsmoTRX
 can be generated during the build process, and is also available online at
-<http://ftp.osmocom.org/docs/latest/osmotrx-usermanual.pdf>.
+<https://ftp.osmocom.org/docs/latest/osmotrx-usermanual.pdf>.
+
+Forum
+-----
+
+We welcome any osmo-trx related discussions in the
+[Cellular Network Infrastructure -> 2 RAN (GERAN)](https://discourse.osmocom.org/c/cni/geran)
+section of the osmocom discourse (web based Forum).

 Mailing List
 ------------
@@ -52,13 +57,20 @@ Please observe the [Osmocom Mailing List
 Rules](https://osmocom.org/projects/cellular-infrastructure/wiki/Mailing_List_Rules)
 when posting.

+Issue Tracker
+-------------
+
+We use the [issue tracker of the osmo-trx project on osmocom.org](https://osmocom.org/projects/osmotrx/issues) for
+tracking the state of bug reports and feature requests.  Feel free to submit any issues you may find, or help
+us out by resolving existing issues.
+
 Contributing
 ------------

 Our coding standards are described at
 <https://osmocom.org/projects/cellular-infrastructure/wiki/Coding_standards>

-We us a gerrit based patch submission/review process for managing contributions.
+We use a Gerrit based patch submission/review process for managing contributions.
 Please see <https://osmocom.org/projects/cellular-infrastructure/wiki/Gerrit>
 for more details

--- a/9
+++ b/9
@@ -0,0 +1,9 @@
+# When cleaning up this file: bump API version in corresponding Makefile.am and rename corresponding debian/lib*.install
+# according to https://osmocom.org/projects/cellular-infrastructure/wiki/Make_a_new_release
+# In short: https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html#Updating-version-info
+# LIBVERSION=c:r:a
+# If the library source code has changed at all since the last update, then increment revision: c:r + 1:a.
+# If any interfaces have been added, removed, or changed since the last update: c + 1:0:a.
+# If any interfaces have been added since the last public release: c:r:a + 1.
+# If any interfaces have been removed or changed since the last public release: c:r:0.
+#library	what			description / commit summary line
--- a/Transceiver52M/ChannelizerBase.cpp
+++ b/Transceiver52M/ChannelizerBase.cpp
@@ -244,6 +244,7 @@ ChannelizerBase::~ChannelizerBase()
 		free(subFilters[i]);
 		delete[] hist[i];
 	}
+	free(subFilters);

 	fft_free(fftInput);
 	fft_free(fftOutput);
--- a/Transceiver52M/Complex.h
+++ b/Transceiver52M/Complex.h
@@ -29,7 +29,7 @@ unlike the built-in complex<> templates, these inline most operations for speed
 template<class Real> class Complex {

 public:
-
+  typedef Real value_type;
  Real r, i;

  /**@name constructors */
--- a/Transceiver52M/Makefile.am
+++ b/Transceiver52M/Makefile.am
@@ -40,7 +40,9 @@ COMMON_SOURCES = \
 	ChannelizerBase.cpp \
 	Channelizer.cpp \
 	Synthesis.cpp \
-	proto_trxd.c
+	proto_trxd.c \
+	grgsm_vitac/grgsm_vitac.cpp \
+	grgsm_vitac/viterbi_detector.cc

 libtransceiver_common_la_SOURCES = \
 	$(COMMON_SOURCES) \
@@ -73,6 +75,47 @@ COMMON_LDADD = \
 	$(LIBOSMOCTRL_LIBS) \
 	$(LIBOSMOVTY_LIBS)

+if ENABLE_MS_TRX
+AM_CPPFLAGS += -I$(top_srcdir)/osmocom-bb/src/host/trxcon/include/
+AM_CPPFLAGS += -I${srcdir}
+
+TRXCON_LDADD = \
+	$(top_builddir)/osmocom-bb/src/host/trxcon/src/.libs/libtrxcon.a \
+	$(top_builddir)/osmocom-bb/src/host/trxcon/src/.libs/libl1sched.a \
+	$(top_builddir)/osmocom-bb/src/host/trxcon/src/.libs/libl1gprs.a \
+	$(LIBOSMOCODING_LIBS)
+
+MS_LOWER_SRC = \
+	ms/sch.c \
+	ms/ms.cpp \
+	ms/threadsched.cpp \
+	ms/ms_rx_lower.cpp \
+	grgsm_vitac/grgsm_vitac.cpp \
+	grgsm_vitac/viterbi_detector.cc
+
+MS_UPPER_SRC = \
+	ms/ms_upper.cpp \
+	ms/l1ctl_server.c \
+	ms/logging.c \
+	ms/l1ctl_server_cb.cpp \
+	ms/ms_trxcon_if.cpp
+
+noinst_HEADERS += \
+   	ms/ms.h \
+	ms/threadsched.h \
+	ms/bladerf_specific.h \
+	ms/uhd_specific.h \
+	ms/ms_upper.h \
+	ms/ms_trxcon_if.h \
+	ms/itrq.h \
+	ms/sch.h \
+	ms/threadpool.h \
+	grgsm_vitac/viterbi_detector.h \
+	grgsm_vitac/constants.h \
+	grgsm_vitac/grgsm_vitac.h
+
+endif
+
 bin_PROGRAMS =

 if DEVICE_UHD
@@ -83,6 +126,17 @@ osmo_trx_uhd_LDADD = \
 	$(COMMON_LDADD) \
 	$(UHD_LIBS)
 osmo_trx_uhd_CPPFLAGS  = $(AM_CPPFLAGS) $(UHD_CFLAGS)
+
+#if ENABLE_MS_TRX
+#bin_PROGRAMS += osmo-trx-ms-uhd
+#osmo_trx_ms_uhd_SOURCES = $(MS_LOWER_SRC) $(MS_UPPER_SRC)
+#osmo_trx_ms_uhd_LDADD = \
+#	$(builddir)/device/uhd/libdevice.la \
+#	$(COMMON_LDADD) \
+#	$(UHD_LIBS) \
+#	$(TRXCON_LDADD)
+#osmo_trx_ms_uhd_CPPFLAGS  = $(AM_CPPFLAGS) $(UHD_CFLAGS) -DBUILDUHD
+#endif
 endif

 if DEVICE_USRP1
@@ -104,3 +158,33 @@ osmo_trx_lms_LDADD = \
 	$(LMS_LIBS)
 osmo_trx_lms_CPPFLAGS  = $(AM_CPPFLAGS) $(LMS_CFLAGS)
 endif
+
+if DEVICE_BLADE
+bin_PROGRAMS += osmo-trx-blade
+osmo_trx_blade_SOURCES = osmo-trx.cpp
+osmo_trx_blade_LDADD = \
+	$(builddir)/device/bladerf/libdevice.la \
+	$(COMMON_LDADD) \
+	$(BLADE_LIBS)
+osmo_trx_blade_CPPFLAGS  = $(AM_CPPFLAGS) $(LMS_CFLAGS)
+
+if ENABLE_MS_TRX
+bin_PROGRAMS += osmo-trx-ms-blade
+osmo_trx_ms_blade_SOURCES = $(MS_LOWER_SRC) $(MS_UPPER_SRC)
+osmo_trx_ms_blade_LDADD = \
+	$(builddir)/device/bladerf/libdevice.la \
+	$(COMMON_LDADD) \
+	$(BLADE_LIBS) \
+	$(TRXCON_LDADD)
+osmo_trx_ms_blade_CPPFLAGS  = $(AM_CPPFLAGS) $(BLADE_CFLAGS) -DBUILDBLADE
+endif
+endif
+
+if DEVICE_IPC
+bin_PROGRAMS += osmo-trx-ipc
+osmo_trx_ipc_SOURCES = osmo-trx.cpp
+osmo_trx_ipc_LDADD = \
+	$(builddir)/device/ipc/libdevice.la \
+	$(COMMON_LDADD)
+osmo_trx_ipc_CPPFLAGS  = $(AM_CPPFLAGS)
+endif
--- a/Transceiver52M/Resampler.cpp
+++ b/Transceiver52M/Resampler.cpp
@@ -13,10 +13,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #include <stdlib.h>
@@ -36,7 +32,7 @@ extern "C" {
 #define M_PI			3.14159265358979323846264338327f
 #endif

-#define MAX_OUTPUT_LEN		4096
+#define MAX_OUTPUT_LEN		4096*4

 using namespace std;

@@ -99,6 +95,7 @@ void Resampler::initFilters(float bw)
 		reverse(&part[0], &part[filt_len]);
 }

+#ifndef __OPTIMIZE__
 static bool check_vec_len(int in_len, int out_len, int p, int q)
 {
 	if (in_len % q) {
@@ -129,14 +126,15 @@ static bool check_vec_len(int in_len, int out_len, int p, int q)

 	return true;
 }
+#endif

 int Resampler::rotate(const float *in, size_t in_len, float *out, size_t out_len)
 {
 	int n, path;
-
+#ifndef __OPTIMIZE__
 	if (!check_vec_len(in_len, out_len, p, q))
 		return -1;
-
+#endif
 	/* Generate output from precomputed input/output paths */
 	for (size_t i = 0; i < out_len; i++) {
 		n = in_index[i];
--- a/Transceiver52M/Resampler.h
+++ b/Transceiver52M/Resampler.h
@@ -13,10 +13,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #ifndef _RESAMPLER_H_
--- a/Transceiver52M/Transceiver.cpp
+++ b/Transceiver52M/Transceiver.cpp
@@ -29,6 +29,7 @@
 #include <fstream>
 #include "Transceiver.h"
 #include <Logger.h>
+#include <grgsm_vitac/grgsm_vitac.h>

 extern "C" {
 #include "osmo_signal.h"
@@ -37,6 +38,7 @@ extern "C" {
 #include <osmocom/core/utils.h>
 #include <osmocom/core/socket.h>
 #include <osmocom/core/bits.h>
+#include <osmocom/vty/cpu_sched_vty.h>
 }

 #ifdef HAVE_CONFIG_H
@@ -45,13 +47,24 @@ extern "C" {

 using namespace GSM;

+Transceiver *transceiver;
+
 #define USB_LATENCY_INTRVL		10,0

 /* Number of running values use in noise average */
 #define NOISE_CNT			20

+
+static void dispatch_trx_rate_ctr_change(TransceiverState *state, unsigned int chan) {
+        thread_enable_cancel(false);
+        state->ctrs.chan = chan;
+        osmo_signal_dispatch(SS_DEVICE, S_TRX_COUNTER_CHANGE, &state->ctrs);
+        thread_enable_cancel(true);
+}
+
 TransceiverState::TransceiverState()
-  : mRetrans(false), mNoiseLev(0.0), mNoises(NOISE_CNT), mPower(0.0)
+  : mFiller(FILLER_ZERO), mRetrans(false), mNoiseLev(0.0), mNoises(NOISE_CNT),
+    mPower(0.0), mMuted(false), first_dl_fn_rcv()
 {
  for (int i = 0; i < 8; i++) {
    chanType[i] = Transceiver::NONE;
@@ -63,6 +76,7 @@ TransceiverState::TransceiverState()
    for (int n = 0; n < 102; n++)
      fillerTable[n][i] = NULL;
  }
+  memset(&ctrs, 0, sizeof(struct trx_counters));
 }

 TransceiverState::~TransceiverState()
@@ -84,6 +98,8 @@ bool TransceiverState::init(FillerType filler, size_t sps, float scale, size_t r
  if ((sps != 1) && (sps != 4))
    return false;

+  mFiller = filler;
+
  for (size_t n = 0; n < 8; n++) {
    for (size_t i = 0; i < 102; i++) {
      switch (filler) {
@@ -117,26 +133,22 @@ bool TransceiverState::init(FillerType filler, size_t sps, float scale, size_t r
  return false;
 }

-Transceiver::Transceiver(int wBasePort,
-                         const char *TRXAddress,
-                         const char *GSMcoreAddress,
-                         size_t tx_sps, size_t rx_sps, size_t chans,
+Transceiver::Transceiver(const struct trx_cfg *cfg,
                         GSM::Time wTransmitLatency,
-                         RadioInterface *wRadioInterface,
-                         double wRssiOffset, int wStackSize)
-  : mBasePort(wBasePort), mLocalAddr(TRXAddress), mRemoteAddr(GSMcoreAddress),
-    mClockSocket(-1), mTransmitLatency(wTransmitLatency), mRadioInterface(wRadioInterface),
-    rssiOffset(wRssiOffset), stackSize(wStackSize),
-    mSPSTx(tx_sps), mSPSRx(rx_sps), mChans(chans), mExtRACH(false), mEdge(false),
-    mOn(false), mForceClockInterface(false),
-    mTxFreq(0.0), mRxFreq(0.0), mTSC(0), mMaxExpectedDelayAB(0), mMaxExpectedDelayNB(0),
-    mWriteBurstToDiskMask(0)
+                         RadioInterface *wRadioInterface)
+  : mChans(cfg->num_chans), cfg(cfg),
+    mCtrlSockets(mChans), mClockSocket(-1),
+    mTxPriorityQueues(mChans), mReceiveFIFO(mChans),
+    mRxServiceLoopThreads(mChans), mRxLowerLoopThread(nullptr), mTxLowerLoopThread(nullptr),
+    mTxPriorityQueueServiceLoopThreads(mChans), mTransmitLatency(wTransmitLatency), mRadioInterface(wRadioInterface),
+    mOn(false),mForceClockInterface(false), mTxFreq(0.0), mRxFreq(0.0), mTSC(0), mMaxExpectedDelayAB(0),
+    mMaxExpectedDelayNB(0), mWriteBurstToDiskMask(0), mVersionTRXD(mChans), mStates(mChans)
 {
  txFullScale = mRadioInterface->fullScaleInputValue();
  rxFullScale = mRadioInterface->fullScaleOutputValue();

-  for (int i = 0; i < 8; i++) {
-    for (int j = 0; j < 8; j++)
+  for (size_t i = 0; i < ARRAY_SIZE(mHandover); i++) {
+    for (size_t j = 0; j < ARRAY_SIZE(mHandover[i]); j++)
      mHandover[i][j] = false;
  }
 }
@@ -151,20 +163,30 @@ Transceiver::~Transceiver()
    close(mClockSocket);

  for (size_t i = 0; i < mChans; i++) {
-    if (mControlServiceLoopThreads[i]) {
-      mControlServiceLoopThreads[i]->cancel();
-      mControlServiceLoopThreads[i]->join();
-      delete mControlServiceLoopThreads[i];
-    }
-
    mTxPriorityQueues[i].clear();
-    if (mCtrlSockets[i] >= 0)
-      close(mCtrlSockets[i]);
    if (mDataSockets[i] >= 0)
      close(mDataSockets[i]);
  }
 }

+int Transceiver::ctrl_sock_cb(struct osmo_fd *bfd, unsigned int flags)
+{
+  int rc = 0;
+  int chan = static_cast<int>(reinterpret_cast<uintptr_t>(bfd->data));
+
+  if (flags & OSMO_FD_READ)
+    rc = transceiver->ctrl_sock_handle_rx(chan);
+  if (rc < 0)
+    osmo_signal_dispatch(SS_MAIN, S_MAIN_STOP_REQUIRED, NULL);
+
+  if (flags & OSMO_FD_WRITE)
+    rc = transceiver->ctrl_sock_write(chan);
+  if (rc < 0)
+    osmo_signal_dispatch(SS_MAIN, S_MAIN_STOP_REQUIRED, NULL);
+
+  return rc;
+}
+
 /*
 * Initialize transceiver
 *
@@ -174,11 +196,9 @@ Transceiver::~Transceiver()
 * are still expected to report clock indications through control channel
 * activity.
 */
-bool Transceiver::init(FillerType filler, size_t rtsc, unsigned rach_delay,
-                       bool edge, bool ext_rach)
+bool Transceiver::init()
 {
  int d_srcport, d_dstport, c_srcport, c_dstport;
-
  if (!mChans) {
    LOG(FATAL) << "No channels assigned";
    return false;
@@ -189,51 +209,53 @@ bool Transceiver::init(FillerType filler, size_t rtsc, unsigned rach_delay,
    return false;
  }

-  mExtRACH = ext_rach;
-  mEdge = edge;
+  initvita();

  mDataSockets.resize(mChans, -1);
-  mCtrlSockets.resize(mChans, -1);
-  mControlServiceLoopThreads.resize(mChans);
-  mTxPriorityQueueServiceLoopThreads.resize(mChans);
-  mRxServiceLoopThreads.resize(mChans);

-  mTxPriorityQueues.resize(mChans);
-  mReceiveFIFO.resize(mChans);
-  mStates.resize(mChans);
-  mVersionTRXD.resize(mChans);

  /* Filler table retransmissions - support only on channel 0 */
-  if (filler == FILLER_DUMMY)
+  if (cfg->filler == FILLER_DUMMY)
    mStates[0].mRetrans = true;

  /* Setup sockets */
  mClockSocket = osmo_sock_init2(AF_UNSPEC, SOCK_DGRAM, IPPROTO_UDP,
-				    mLocalAddr.c_str(), mBasePort,
-				    mRemoteAddr.c_str(), mBasePort + 100,
+				    cfg->bind_addr, cfg->base_port,
+				    cfg->remote_addr, cfg->base_port + 100,
 				    OSMO_SOCK_F_BIND | OSMO_SOCK_F_CONNECT);
  if (mClockSocket < 0)
    return false;

  for (size_t i = 0; i < mChans; i++) {
-    c_srcport = mBasePort + 2 * i + 1;
-    c_dstport = mBasePort + 2 * i + 101;
-    d_srcport = mBasePort + 2 * i + 2;
-    d_dstport = mBasePort + 2 * i + 102;
+    int rv;
+    FillerType filler = cfg->filler;
+    c_srcport = cfg->base_port + 2 * i + 1;
+    c_dstport = cfg->base_port + 2 * i + 101;
+    d_srcport = cfg->base_port + 2 * i + 2;
+    d_dstport = cfg->base_port + 2 * i + 102;

-    mCtrlSockets[i] = osmo_sock_init2(AF_UNSPEC, SOCK_DGRAM, IPPROTO_UDP,
-                                      mLocalAddr.c_str(), c_srcport,
-                                      mRemoteAddr.c_str(), c_dstport,
+    rv = osmo_sock_init2_ofd(&mCtrlSockets[i].conn_bfd, AF_UNSPEC, SOCK_DGRAM, IPPROTO_UDP,
+                                      cfg->bind_addr, c_srcport,
+                                      cfg->remote_addr, c_dstport,
 				      OSMO_SOCK_F_BIND | OSMO_SOCK_F_CONNECT);
-    if (mCtrlSockets[i] < 0)
+    if (rv < 0)
      return false;

+    mCtrlSockets[i].conn_bfd.cb = ctrl_sock_cb;
+    mCtrlSockets[i].conn_bfd.data = reinterpret_cast<void*>(i);
+
+
    mDataSockets[i] = osmo_sock_init2(AF_UNSPEC, SOCK_DGRAM, IPPROTO_UDP,
-                                      mLocalAddr.c_str(), d_srcport,
-                                      mRemoteAddr.c_str(), d_dstport,
+                                      cfg->bind_addr, d_srcport,
+                                      cfg->remote_addr, d_dstport,
 				      OSMO_SOCK_F_BIND | OSMO_SOCK_F_CONNECT);
-    if (mCtrlSockets[i] < 0)
+    if (mDataSockets[i] < 0)
      return false;
+
+    if (i && filler == FILLER_DUMMY)
+      filler = FILLER_ZERO;
+
+    mStates[i].init(filler, cfg->tx_sps, txFullScale, cfg->rtsc, cfg->rach_delay);
  }

  /* Randomize the central clock */
@@ -243,21 +265,6 @@ bool Transceiver::init(FillerType filler, size_t rtsc, unsigned rach_delay,
  mLastClockUpdateTime = startTime;
  mLatencyUpdateTime = startTime;

-  /* Start control threads */
-  for (size_t i = 0; i < mChans; i++) {
-    TrxChanThParams *params = (TrxChanThParams *)malloc(sizeof(struct TrxChanThParams));
-    params->trx = this;
-    params->num = i;
-    mControlServiceLoopThreads[i] = new Thread(stackSize);
-    mControlServiceLoopThreads[i]->start((void * (*)(void*))
-                                 ControlServiceLoopAdapter, (void*) params);
-
-    if (i && filler == FILLER_DUMMY)
-      filler = FILLER_ZERO;
-
-    mStates[i].init(filler, mSPSTx, txFullScale, rtsc, rach_delay);
-  }
-
  return true;
 }

@@ -290,8 +297,8 @@ bool Transceiver::start()
  }

  /* Device is running - launch I/O threads */
-  mRxLowerLoopThread = new Thread(stackSize);
-  mTxLowerLoopThread = new Thread(stackSize);
+  mRxLowerLoopThread = new Thread(cfg->stack_size);
+  mTxLowerLoopThread = new Thread(cfg->stack_size);
  mTxLowerLoopThread->start((void * (*)(void*))
                            TxLowerLoopAdapter,(void*) this);
  mRxLowerLoopThread->start((void * (*)(void*))
@@ -302,14 +309,14 @@ bool Transceiver::start()
    TrxChanThParams *params = (TrxChanThParams *)malloc(sizeof(struct TrxChanThParams));
    params->trx = this;
    params->num = i;
-    mRxServiceLoopThreads[i] = new Thread(stackSize);
+    mRxServiceLoopThreads[i] = new Thread(cfg->stack_size);
    mRxServiceLoopThreads[i]->start((void * (*)(void*))
                            RxUpperLoopAdapter, (void*) params);

    params = (TrxChanThParams *)malloc(sizeof(struct TrxChanThParams));
    params->trx = this;
    params->num = i;
-    mTxPriorityQueueServiceLoopThreads[i] = new Thread(stackSize);
+    mTxPriorityQueueServiceLoopThreads[i] = new Thread(cfg->stack_size);
    mTxPriorityQueueServiceLoopThreads[i]->start((void * (*)(void*))
                            TxUpperLoopAdapter, (void*) params);
  }
@@ -382,11 +389,11 @@ void Transceiver::addRadioVector(size_t chan, BitVector &bits,

  /* Use the number of bits as the EDGE burst indicator */
  if (bits.size() == EDGE_BURST_NBITS)
-    burst = modulateEdgeBurst(bits, mSPSTx);
+    burst = modulateEdgeBurst(bits, cfg->tx_sps);
  else
-    burst = modulateBurst(bits, 8 + (wTime.TN() % 4 == 0), mSPSTx);
+    burst = modulateBurst(bits, 8 + (wTime.TN() % 4 == 0), cfg->tx_sps);

-  scaleVector(*burst, txFullScale * pow(10, -RSSI / 10));
+  scaleVector(*burst, txFullScale * pow(10, (double) -RSSI / 20));

  radio_burst = new radioVector(wTime, burst);

@@ -414,24 +421,29 @@ void Transceiver::pushRadioVector(GSM::Time &nowTime)
  std::vector<signalVector *> bursts(mChans);
  std::vector<bool> zeros(mChans);
  std::vector<bool> filler(mChans, true);
+  bool ratectr_changed;
+
+  TN = nowTime.TN();

  for (size_t i = 0; i < mChans; i ++) {
    state = &mStates[i];
+    ratectr_changed = false;
+
+    zeros[i] = state->chanType[TN] == NONE || state->mMuted;
+
+    Mutex *mtx = mTxPriorityQueues[i].getMutex();
+    mtx->lock();

    while ((burst = mTxPriorityQueues[i].getStaleBurst(nowTime))) {
-      LOGCHAN(i, DTRXDDL, NOTICE) << "dumping STALE burst in TRX->SDR interface ("
+      LOGCHAN(i, DTRXDDL, INFO) << "dumping STALE burst in TRX->SDR interface ("
                  << burst->getTime() <<" vs " << nowTime << "), retrans=" << state->mRetrans;
+      state->ctrs.tx_stale_bursts++;
+      ratectr_changed = true;
      if (state->mRetrans)
        updateFillerTable(i, burst);
      delete burst;
    }

-    TN = nowTime.TN();
-    modFN = nowTime.FN() % state->fillerModulus[TN];
-
-    bursts[i] = state->fillerTable[modFN][TN];
-    zeros[i] = state->chanType[TN] == NONE;
-
    if ((burst = mTxPriorityQueues[i].getCurrentBurst(nowTime))) {
      bursts[i] = burst->getVector();

@@ -443,7 +455,21 @@ void Transceiver::pushRadioVector(GSM::Time &nowTime)
      }

      delete burst;
+    } else {
+      modFN = nowTime.FN() % state->fillerModulus[TN];
+      bursts[i] = state->fillerTable[modFN][TN];
+      if (i == 0 && state->mFiller == FILLER_ZERO) {
+        LOGCHAN(i, DTRXDDL, INFO) << "No Tx burst available for " << nowTime
+                                    << ", retrans=" << state->mRetrans;
+        state->ctrs.tx_unavailable_bursts++;
+        ratectr_changed = true;
+      }
    }
+
+    mtx->unlock();
+
+    if (ratectr_changed)
+      dispatch_trx_rate_ctr_change(state, i);
  }

  mRadioInterface->driveTransmitRadio(bursts, zeros);
@@ -528,16 +554,16 @@ CorrType Transceiver::expectedCorrType(GSM::Time currTime,
    break;
  case IV:
  case VI:
-    return mExtRACH ? EXT_RACH : RACH;
+    return cfg->ext_rach ? EXT_RACH : RACH;
    break;
  case V: {
    int mod51 = burstFN % 51;
    if ((mod51 <= 36) && (mod51 >= 14))
-      return mExtRACH ? EXT_RACH : RACH;
+      return cfg->ext_rach ? EXT_RACH : RACH;
    else if ((mod51 == 4) || (mod51 == 5))
-      return mExtRACH ? EXT_RACH : RACH;
+      return cfg->ext_rach ? EXT_RACH : RACH;
    else if ((mod51 == 45) || (mod51 == 46))
-      return mExtRACH ? EXT_RACH : RACH;
+      return cfg->ext_rach ? EXT_RACH : RACH;
    else if (mHandover[burstTN][sdcch4_subslot[burstFN % 102]])
      return RACH;
    else
@@ -555,11 +581,11 @@ CorrType Transceiver::expectedCorrType(GSM::Time currTime,
  case XIII: {
    int mod52 = burstFN % 52;
    if ((mod52 == 12) || (mod52 == 38))
-      return mExtRACH ? EXT_RACH : RACH;
+      return RACH; /* RACH is always 8-bit on PTCCH/U */
    else if ((mod52 == 25) || (mod52 == 51))
      return IDLE;
    else /* Enable 8-PSK burst detection if EDGE is enabled */
-      return mEdge ? EDGE : TSC;
+      return cfg->egprs ? EDGE : TSC;
    break;
  }
  case LOOPBACK:
@@ -584,6 +610,51 @@ void writeToFile(radioVector *radio_burst, size_t chan)
  outfile.close();
 }

+double Transceiver::rssiOffset(size_t chan)
+{
+  if (cfg->force_rssi_offset)
+        return cfg->rssi_offset;
+  return mRadioInterface->rssiOffset(chan) + cfg->rssi_offset;
+}
+
+static SoftVector *demodAnyBurst_va(const signalVector &burst, CorrType type, int sps, int rach_max_toa, int tsc)
+{
+	auto conved_beg = reinterpret_cast<const std::complex<float> *>(&burst.begin()[0]);
+	std::complex<float> chan_imp_resp[CHAN_IMP_RESP_LENGTH * d_OSR];
+	float ncmax;
+	const unsigned burst_len_bits = 148 + 8;
+	char demodded_softbits[burst_len_bits];
+	SoftVector *bits = new SoftVector(burst_len_bits);
+
+	if (type == CorrType::TSC) {
+		auto rach_burst_start = get_norm_chan_imp_resp(conved_beg, chan_imp_resp, &ncmax, tsc);
+		rach_burst_start = std::max(rach_burst_start, 0);
+		detect_burst_nb(conved_beg, chan_imp_resp, rach_burst_start, demodded_softbits);
+	} else {
+		auto normal_burst_start = get_access_imp_resp(conved_beg, chan_imp_resp, &ncmax, 0);
+		normal_burst_start = std::max(normal_burst_start, 0);
+		detect_burst_ab(conved_beg, chan_imp_resp, normal_burst_start, demodded_softbits, rach_max_toa);
+	}
+
+	float *s = &bits->begin()[0];
+	for (unsigned int i = 0; i < 148; i++)
+		s[i] = demodded_softbits[i] * -1;
+	for (unsigned int i = 148; i < burst_len_bits; i++)
+		s[i] = 0;
+	return bits;
+}
+
+#define USE_VA
+
+#ifdef USE_VA
+// signalvector is owning despite claiming not to, but we can pretend, too..
+static void dummy_free(void *wData){};
+static void *dummy_alloc(size_t newSize)
+{
+	return 0;
+};
+#endif
+
 /*
 * Pull bursts from the FIFO and handle according to the slot
 * and burst correlation type. Equalzation is currently disabled.
@@ -602,6 +673,11 @@ int Transceiver::pullRadioVector(size_t chan, struct trx_ul_burst_ind *bi)
  GSM::Time burstTime;
  SoftVector *rxBurst;
  TransceiverState *state = &mStates[chan];
+  bool ctr_changed = false;
+  double rssi_offset;
+  static complex burst_shift_buffer[625];
+  static signalVector shift_vec(burst_shift_buffer, 0, 625, dummy_alloc, dummy_free);
+  signalVector *shvec_ptr = &shift_vec;

  /* Blocking FIFO read */
  radioVector *radio_burst = mReceiveFIFO[chan]->read();
@@ -611,7 +687,7 @@ int Transceiver::pullRadioVector(size_t chan, struct trx_ul_burst_ind *bi)
  }

  /* Set time and determine correlation type */
-  burstTime = radio_burst->getTime();
+  burstTime = radio_burst->getTime() + cfg->ul_fn_offset;
  CorrType type = expectedCorrType(burstTime, chan);

  /* Initialize struct bi */
@@ -640,9 +716,13 @@ int Transceiver::pullRadioVector(size_t chan, struct trx_ul_burst_ind *bi)
    return -ENOENT;
  }

+  /* If TRX RF is locked/muted by BTS, send idle burst indications */
+  if (state->mMuted)
+    goto ret_idle;
+
  /* Select the diversity channel with highest energy */
  for (size_t i = 0; i < radio_burst->chans(); i++) {
-    float pow = energyDetect(*radio_burst->getVector(i), 20 * mSPSRx);
+    float pow = energyDetect(*radio_burst->getVector(i), 20 * cfg->rx_sps);
    if (pow > max) {
      max = pow;
      max_i = i;
@@ -651,7 +731,9 @@ int Transceiver::pullRadioVector(size_t chan, struct trx_ul_burst_ind *bi)
  }

  if (max_i < 0) {
-    LOGCHAN(chan, DTRXDUL, FATAL) << "Received empty burst";
+    LOGCHAN(chan, DTRXDUL, INFO) << "Received empty burst";
+    state->ctrs.rx_empty_burst++;
+    ctr_changed = true;
    goto ret_idle;
  }

@@ -665,8 +747,9 @@ int Transceiver::pullRadioVector(size_t chan, struct trx_ul_burst_ind *bi)
    state->mNoiseLev = state->mNoises.avg();
  }

-  bi->rssi = 20.0 * log10(rxFullScale / avg) + rssiOffset;
-  bi->noise = 20.0 * log10(rxFullScale / state->mNoiseLev) + rssiOffset;
+  rssi_offset = rssiOffset(chan);
+  bi->rssi = 20.0 * log10(rxFullScale / avg) + rssi_offset;
+  bi->noise = 20.0 * log10(rxFullScale / state->mNoiseLev) + rssi_offset;

  if (type == IDLE)
    goto ret_idle;
@@ -674,21 +757,38 @@ int Transceiver::pullRadioVector(size_t chan, struct trx_ul_burst_ind *bi)
  max_toa = (type == RACH || type == EXT_RACH) ?
            mMaxExpectedDelayAB : mMaxExpectedDelayNB;

+  if (cfg->use_va) {
+    // shifted burst copy to make the old demod and detection happy
+    std::copy(burst->begin() + 20, burst->end() - 20, shift_vec.begin());
+  } else {
+    shvec_ptr = burst;
+  }
+
  /* Detect normal or RACH bursts */
-  rc = detectAnyBurst(*burst, mTSC, BURST_THRESH, mSPSRx, type, max_toa, &ebp);
+  rc = detectAnyBurst(*shvec_ptr, mTSC, BURST_THRESH, cfg->rx_sps, type, max_toa, &ebp);
  if (rc <= 0) {
-    if (rc == -SIGERR_CLIP)
-      LOGCHAN(chan, DTRXDUL, NOTICE) << "Clipping detected on received RACH or Normal Burst";
-    else if (rc != SIGERR_NONE)
-      LOGCHAN(chan, DTRXDUL, NOTICE) << "Unhandled RACH or Normal Burst detection error";
+    if (rc == -SIGERR_CLIP) {
+      LOGCHAN(chan, DTRXDUL, INFO) << "Clipping detected on received RACH or Normal Burst";
+      state->ctrs.rx_clipping++;
+      ctr_changed = true;
+    } else if (rc != SIGERR_NONE) {
+      LOGCHAN(chan, DTRXDUL, INFO) << "Unhandled RACH or Normal Burst detection error";
+      state->ctrs.rx_no_burst_detected++;
+      ctr_changed = true;
+    }
    goto ret_idle;
  }

-  type = (CorrType) rc;
+  if (cfg->use_va) {
+    scaleVector(*burst, { (1. / (float)((1 << 14) - 1)), 0 });
+    rxBurst = demodAnyBurst_va(*burst, (CorrType)rc, cfg->rx_sps, max_toa, mTSC);
+  } else {
+    rxBurst = demodAnyBurst(*shvec_ptr, (CorrType)rc, cfg->rx_sps, &ebp);
+  }
+
  bi->toa = ebp.toa;
  bi->tsc = ebp.tsc;
  bi->ci = ebp.ci;
-  rxBurst = demodAnyBurst(*burst, mSPSRx, ebp.amp, ebp.toa, type);

  /* EDGE demodulator returns 444 (gSlotLen * 3) bits */
  if (rxBurst->size() == EDGE_BURST_NBITS) {
@@ -707,6 +807,8 @@ int Transceiver::pullRadioVector(size_t chan, struct trx_ul_burst_ind *bi)
  return 0;

 ret_idle:
+  if (ctr_changed)
+    dispatch_trx_rate_ctr_change(state, chan);
  bi->idle = true;
  delete radio_burst;
  return 0;
@@ -719,8 +821,6 @@ void Transceiver::reset()
 }


-#define MAX_PACKET_LENGTH 100
-
 /**
 * Matches a buffer with a command.
 * @param  buf    a buffer to look command in
@@ -750,27 +850,77 @@ static bool match_cmd(char *buf,
  return true;
 }

-bool Transceiver::driveControl(size_t chan)
+void Transceiver::ctrl_sock_send(ctrl_msg& m, int chan)
 {
-  char buffer[MAX_PACKET_LENGTH + 1];
-  char response[MAX_PACKET_LENGTH + 1];
+  ctrl_sock_state& s = mCtrlSockets[chan];
+  struct osmo_fd *conn_bfd = &s.conn_bfd;
+
+  s.txmsgqueue.push_back(m);
+  osmo_fd_write_enable(conn_bfd);
+}
+
+int Transceiver::ctrl_sock_write(int chan)
+{
+  int rc;
+  ctrl_sock_state& s = mCtrlSockets[chan];
+
+  if (s.conn_bfd.fd < 0) {
+      return -EIO;
+  }
+
+  while (s.txmsgqueue.size()) {
+    const ctrl_msg m = s.txmsgqueue.front();
+
+    osmo_fd_write_disable(&s.conn_bfd);
+
+    /* try to send it over the socket */
+    rc = write(s.conn_bfd.fd, m.data, strlen(m.data) + 1);
+    if (rc == 0)
+      goto close;
+    if (rc < 0) {
+      if (errno == EAGAIN) {
+        osmo_fd_write_enable(&s.conn_bfd);
+        break;
+      }
+      goto close;
+    }
+
+      s.txmsgqueue.pop_front();
+  }
+  return 0;
+
+close:
+  LOGCHAN(chan, DTRXCTRL, NOTICE) << "mCtrlSockets write(" << s.conn_bfd.fd << ") failed: " << rc;
+  return -1;
+}
+
+int Transceiver::ctrl_sock_handle_rx(int chan)
+{
+  ctrl_msg cmd_received;
+  ctrl_msg cmd_to_send;
+  char *buffer = cmd_received.data;
+  char *response = cmd_to_send.data;
  char *command, *params;
  int msgLen;
+  ctrl_sock_state& s = mCtrlSockets[chan];

  /* Attempt to read from control socket */
-  msgLen = read(mCtrlSockets[chan], buffer, MAX_PACKET_LENGTH);
+  msgLen = read(s.conn_bfd.fd, buffer, sizeof(cmd_received.data)-1);
+  if (msgLen < 0 && errno == EAGAIN)
+      return 0; /* Try again later */
  if (msgLen <= 0) {
-    LOGCHAN(chan, DTRXCTRL, NOTICE) << "mCtrlSockets read(" << mCtrlSockets[chan] << ") failed: " << msgLen;
-    return false;
+    LOGCHAN(chan, DTRXCTRL, NOTICE) << "mCtrlSockets read(" << s.conn_bfd.fd << ") failed: " << msgLen;
+    return -EIO;
  }

+
  /* Zero-terminate received string */
  buffer[msgLen] = '\0';

  /* Verify a command signature */
  if (strncmp(buffer, "CMD ", 4)) {
    LOGCHAN(chan, DTRXCTRL, NOTICE) << "bogus message on control interface";
-    return false;
+    return -EIO;
  }

  /* Set command pointer */
@@ -809,19 +959,18 @@ bool Transceiver::driveControl(size_t chan)
      sprintf(response, "RSP NOHANDOVER 0 %u %u", ts, ss);
    }
  } else if (match_cmd(command, "SETMAXDLY", &params)) {
-    //set expected maximum time-of-arrival
+    //set expected maximum time-of-arrival for Access Bursts
    int maxDelay;
    sscanf(params, "%d", &maxDelay);
    mMaxExpectedDelayAB = maxDelay; // 1 GSM symbol is approx. 1 km
    sprintf(response,"RSP SETMAXDLY 0 %d",maxDelay);
  } else if (match_cmd(command, "SETMAXDLYNB", &params)) {
-    //set expected maximum time-of-arrival
+    //set expected maximum time-of-arrival for Normal Bursts
    int maxDelay;
    sscanf(params, "%d", &maxDelay);
    mMaxExpectedDelayNB = maxDelay; // 1 GSM symbol is approx. 1 km
    sprintf(response,"RSP SETMAXDLYNB 0 %d",maxDelay);
  } else if (match_cmd(command, "SETRXGAIN", &params)) {
-    //set expected maximum time-of-arrival
    int newGain;
    sscanf(params, "%d", &newGain);
    newGain = mRadioInterface->setRxGain(newGain, chan);
@@ -833,7 +982,7 @@ bool Transceiver::driveControl(size_t chan)
              (int) round(20.0 * log10(rxFullScale / lev)));
    }
    else {
-      sprintf(response,"RSP NOISELEV 1  0");
+      sprintf(response,"RSP NOISELEV 1 0");
    }
  } else if (match_cmd(command, "SETPOWER", &params)) {
    int power;
@@ -848,11 +997,14 @@ bool Transceiver::driveControl(size_t chan)
    power = mRadioInterface->setPowerAttenuation(power, chan);
    mStates[chan].mPower = power;
    sprintf(response, "RSP ADJPOWER 0 %d", power);
+} else if (match_cmd(command, "NOMTXPOWER", NULL)) {
+    int power = mRadioInterface->getNominalTxPower(chan);
+    sprintf(response, "RSP NOMTXPOWER 0 %d", power);
  } else if (match_cmd(command, "RXTUNE", &params)) {
    // tune receiver
    int freqKhz;
    sscanf(params, "%d", &freqKhz);
-    mRxFreq = freqKhz * 1e3;
+    mRxFreq = (freqKhz + cfg->freq_offset_khz) * 1e3;
    if (!mRadioInterface->tuneRx(mRxFreq, chan)) {
       LOGCHAN(chan, DTRXCTRL, FATAL) << "RX failed to tune";
       sprintf(response,"RSP RXTUNE 1 %d",freqKhz);
@@ -863,7 +1015,7 @@ bool Transceiver::driveControl(size_t chan)
    // tune txmtr
    int freqKhz;
    sscanf(params, "%d", &freqKhz);
-    mTxFreq = freqKhz * 1e3;
+    mTxFreq = (freqKhz + cfg->freq_offset_khz) * 1e3;
    if (!mRadioInterface->tuneTx(mTxFreq, chan)) {
       LOGCHAN(chan, DTRXCTRL, FATAL) << "TX failed to tune";
       sprintf(response,"RSP TXTUNE 1 %d",freqKhz);
@@ -889,7 +1041,7 @@ bool Transceiver::driveControl(size_t chan)
    if ((timeslot < 0) || (timeslot > 7)) {
      LOGCHAN(chan, DTRXCTRL, NOTICE) << "bogus message on control interface";
      sprintf(response,"RSP SETSLOT 1 %d %d",timeslot,corrCode);
-      return true;
+      return 0;
    }
    mStates[chan].chanType[timeslot] = (ChannelCombination) corrCode;
    setModulus(timeslot, chan);
@@ -901,13 +1053,19 @@ bool Transceiver::driveControl(size_t chan)
    LOGCHAN(chan, DTRXCTRL, INFO) << "BTS requests TRXD version switch: " << version_recv;
    if (version_recv > TRX_DATA_FORMAT_VER) {
      LOGCHAN(chan, DTRXCTRL, INFO) << "rejecting TRXD version " << version_recv
-                                    << "in favor of " <<  TRX_DATA_FORMAT_VER;
+                                    << " in favor of " <<  TRX_DATA_FORMAT_VER;
      sprintf(response, "RSP SETFORMAT %u %u", TRX_DATA_FORMAT_VER, version_recv);
    } else {
      LOGCHAN(chan, DTRXCTRL, NOTICE) << "switching to TRXD version " << version_recv;
      mVersionTRXD[chan] = version_recv;
      sprintf(response, "RSP SETFORMAT %u %u", version_recv, version_recv);
    }
+  } else if (match_cmd(command, "RFMUTE", &params)) {
+    // (Un)mute RF TX and RX
+    unsigned mute;
+    sscanf(params, "%u", &mute);
+    mStates[chan].mMuted = mute ? true : false;
+    sprintf(response, "RSP RFMUTE 0 %u", mute);
  } else if (match_cmd(command, "_SETBURSTTODISKMASK", &params)) {
    // debug command! may change or disappear without notice
    // set a mask which bursts to dump to disk
@@ -921,12 +1079,8 @@ bool Transceiver::driveControl(size_t chan)
  }

  LOGCHAN(chan, DTRXCTRL, INFO) << "response is '" << response << "'";
-  msgLen = write(mCtrlSockets[chan], response, strlen(response) + 1);
-  if (msgLen <= 0) {
-    LOGCHAN(chan, DTRXCTRL, NOTICE) << "mCtrlSockets write(" << mCtrlSockets[chan] << ") failed: " << msgLen;
-    return false;
-  }
-  return true;
+  transceiver->ctrl_sock_send(cmd_to_send, chan);
+  return 0;
 }

 bool Transceiver::driveTxPriorityQueue(size_t chan)
@@ -936,11 +1090,12 @@ bool Transceiver::driveTxPriorityQueue(size_t chan)
  struct trxd_hdr_v01_dl *dl;
  char buffer[sizeof(*dl) + EDGE_BURST_NBITS];
  uint32_t fn;
+  uint8_t tn;

  // check data socket
  msgLen = read(mDataSockets[chan], buffer, sizeof(buffer));
  if (msgLen <= 0) {
-    LOGCHAN(chan, DTRXDDL, NOTICE) << "mDataSockets read(" << mCtrlSockets[chan] << ") failed: " << msgLen;
+    LOGCHAN(chan, DTRXDDL, NOTICE) << "mDataSockets read(" << mDataSockets[chan] << ") failed: " << msgLen;
    return false;
  }

@@ -949,8 +1104,8 @@ bool Transceiver::driveTxPriorityQueue(size_t chan)
      burstLen = gSlotLen;
      break;
    case sizeof(*dl) + EDGE_BURST_NBITS: /* EDGE burst */
-      if (mSPSTx != 4) {
-        LOGCHAN(chan, DTRXDDL, ERROR) << "EDGE burst received but SPS is set to " << mSPSTx;
+      if (cfg->tx_sps != 4) {
+        LOGCHAN(chan, DTRXDDL, ERROR) << "EDGE burst received but SPS is set to " << cfg->tx_sps;
        return false;
      }
      burstLen = EDGE_BURST_NBITS;
@@ -964,6 +1119,7 @@ bool Transceiver::driveTxPriorityQueue(size_t chan)

  /* Convert TDMA FN to the host endianness */
  fn = osmo_load32be(&dl->common.fn);
+  tn = dl->common.tn;

  /* Make sure we support the received header format */
  switch (dl->common.version) {
@@ -977,7 +1133,44 @@ bool Transceiver::driveTxPriorityQueue(size_t chan)
  }

  LOGCHAN(chan, DTRXDDL, DEBUG) << "Rx TRXD message (hdr_ver=" << unsigned(dl->common.version)
-    << "): fn=" << fn << ", tn=" << unsigned(dl->common.tn) << ", burst_len=" << burstLen;
+    << "): fn=" << fn << ", tn=" << unsigned(tn) << ", burst_len=" << burstLen;
+
+  TransceiverState *state = &mStates[chan];
+  GSM::Time currTime = GSM::Time(fn, tn);
+
+  /* Verify proper FN order in DL stream */
+  if (state->first_dl_fn_rcv[tn]) {
+    int32_t delta = GSM::FNDelta(currTime.FN(), state->last_dl_time_rcv[tn].FN());
+    if (delta == 1) {
+        /* usual expected scenario, continue code flow */
+    } else if (delta == 0) {
+      LOGCHAN(chan, DTRXDDL, INFO) << "Rx TRXD msg with repeated FN " << currTime;
+      state->ctrs.tx_trxd_fn_repeated++;
+      dispatch_trx_rate_ctr_change(state, chan);
+      return true;
+    } else if (delta < 0) {
+      LOGCHAN(chan, DTRXDDL, INFO) << "Rx TRXD msg with previous FN " << currTime
+                                     << " vs last " << state->last_dl_time_rcv[tn];
+       state->ctrs.tx_trxd_fn_outoforder++;
+       dispatch_trx_rate_ctr_change(state, chan);
+       /* Allow adding radio vector below, since it gets sorted in the queue */
+    } else if (chan == 0 && state->mFiller == FILLER_ZERO) {
+        /* delta > 1. Some FN was lost in the middle. We can only easily rely
+         * on consecutive FNs in TRX0 since it must transmit continuously in all
+         * setups. Also, osmo-trx supports optionally filling empty bursts on
+         * its own. In that case bts-trx is not obliged to submit all bursts. */
+      LOGCHAN(chan, DTRXDDL, INFO) << "Rx TRXD msg with future FN " << currTime
+                                     << " vs last " << state->last_dl_time_rcv[tn]
+                                     << ", " << delta - 1 << " FN lost";
+      state->ctrs.tx_trxd_fn_skipped += delta - 1;
+      dispatch_trx_rate_ctr_change(state, chan);
+    }
+    if (delta > 0)
+      state->last_dl_time_rcv[tn] = currTime;
+  } else { /* Initial check, simply store state */
+    state->first_dl_fn_rcv[tn] = true;
+    state->last_dl_time_rcv[tn] = currTime;
+  }

  BitVector newBurst(burstLen);
  BitVector::iterator itr = newBurst.begin();
@@ -985,8 +1178,6 @@ bool Transceiver::driveTxPriorityQueue(size_t chan)
  while (itr < newBurst.end())
    *itr++ = *bufferItr++;

-  GSM::Time currTime = GSM::Time(fn, dl->common.tn);
-
  addRadioVector(chan, newBurst, dl->tx_att, currTime);

  return true;
@@ -1003,6 +1194,8 @@ bool Transceiver::driveReceiveRadio()
    return false;

  if (mForceClockInterface || mTransmitDeadlineClock > mLastClockUpdateTime + GSM::Time(216,0)) {
+    if (mForceClockInterface)
+      LOGC(DTRXCLK, NOTICE) << "Sending CLOCK indications";
    mForceClockInterface = false;
    return writeClockInterface();
  }
@@ -1019,11 +1212,13 @@ void Transceiver::logRxBurst(size_t chan, const struct trx_ul_burst_ind *bi)
    else os << "-";
  }

+  double rssi_offset = rssiOffset(chan);
+
  LOGCHAN(chan, DTRXDUL, DEBUG) << std::fixed << std::right
    << " time: "   << unsigned(bi->tn) << ":" << bi->fn
-    << " RSSI: "   << std::setw(5) << std::setprecision(1) << (bi->rssi - rssiOffset)
+    << " RSSI: "   << std::setw(5) << std::setprecision(1) << (bi->rssi - rssi_offset)
                   << "dBFS/" << std::setw(6) << -bi->rssi << "dBm"
-    << " noise: "  << std::setw(5) << std::setprecision(1) << (bi->noise - rssiOffset)
+    << " noise: "  << std::setw(5) << std::setprecision(1) << (bi->noise - rssi_offset)
                   << "dBFS/" << std::setw(6) << -bi->noise << "dBm"
    << " TOA: "    << std::setw(5) << std::setprecision(2) << bi->toa
    << " C/I: "    << std::setw(5) << std::setprecision(2) << bi->ci << "dB"
@@ -1043,7 +1238,7 @@ bool Transceiver::driveReceiveFIFO(size_t chan)
    return false; /* other errors: we want to stop the process */
  }

-  if (!bi.idle)
+  if (!bi.idle && log_check_level(DTRXDUL, LOGL_DEBUG))
    logRxBurst(chan, &bi);

  switch (mVersionTRXD[chan]) {
@@ -1141,6 +1336,7 @@ void *RxUpperLoopAdapter(TrxChanThParams *params)

  snprintf(thread_name, 16, "RxUpper%zu", num);
  set_selfthread_name(thread_name);
+  OSMO_ASSERT(osmo_cpu_sched_vty_apply_localthread() == 0);

  while (1) {
    if (!trx->driveReceiveFIFO(num)) {
@@ -1156,6 +1352,7 @@ void *RxUpperLoopAdapter(TrxChanThParams *params)
 void *RxLowerLoopAdapter(Transceiver *transceiver)
 {
  set_selfthread_name("RxLower");
+  OSMO_ASSERT(osmo_cpu_sched_vty_apply_localthread() == 0);

  while (1) {
    if (!transceiver->driveReceiveRadio()) {
@@ -1171,6 +1368,7 @@ void *RxLowerLoopAdapter(Transceiver *transceiver)
 void *TxLowerLoopAdapter(Transceiver *transceiver)
 {
  set_selfthread_name("TxLower");
+  OSMO_ASSERT(osmo_cpu_sched_vty_apply_localthread() == 0);

  while (1) {
    transceiver->driveTxFIFO();
@@ -1179,28 +1377,6 @@ void *TxLowerLoopAdapter(Transceiver *transceiver)
  return NULL;
 }

-void *ControlServiceLoopAdapter(TrxChanThParams *params)
-{
-  char thread_name[16];
-  Transceiver *trx = params->trx;
-  size_t num = params->num;
-
-  free(params);
-
-  snprintf(thread_name, 16, "CtrlService%zu", num);
-  set_selfthread_name(thread_name);
-
-  while (1) {
-    if (!trx->driveControl(num)) {
-      LOGCHAN(num, DTRXCTRL, FATAL) << "Something went wrong in thread " << thread_name << ", requesting stop";
-      osmo_signal_dispatch(SS_MAIN, S_MAIN_STOP_REQUIRED, NULL);
-      break;
-    }
-    pthread_testcancel();
-  }
-  return NULL;
-}
-
 void *TxUpperLoopAdapter(TrxChanThParams *params)
 {
  char thread_name[16];
@@ -1211,6 +1387,7 @@ void *TxUpperLoopAdapter(TrxChanThParams *params)

  snprintf(thread_name, 16, "TxUpper%zu", num);
  set_selfthread_name(thread_name);
+  OSMO_ASSERT(osmo_cpu_sched_vty_apply_localthread() == 0);

  while (1) {
    if (!trx->driveTxPriorityQueue(num)) {
--- a/Transceiver52M/Transceiver.h
+++ b/Transceiver52M/Transceiver.h
@@ -33,11 +33,14 @@

 extern "C" {
 #include <osmocom/core/signal.h>
+#include <osmocom/core/select.h>
 #include "config_defs.h"
 }

 class Transceiver;

+extern Transceiver *transceiver;
+
 /** Channel descriptor for transceiver object and channel number pair */
 struct TrxChanThParams {
 	Transceiver *trx;
@@ -60,6 +63,7 @@ struct TransceiverState {
  /* The filler table */
  signalVector *fillerTable[102][8];
  int fillerModulus[8];
+  FillerType mFiller;
  bool mRetrans;

  /* Most recent channel estimate of all timeslots */
@@ -76,37 +80,39 @@ struct TransceiverState {

  /* Received noise energy levels */
  float mNoiseLev;
-  noiseVector mNoises;
+  avgVector mNoises;

  /* Shadowed downlink attenuation */
  int mPower;
+
+  /* RF emission and reception disabled, as per NM Administrative State Locked */
+  bool mMuted;
+
+  /* counters */
+  struct trx_counters ctrs;
+
+  /* Used to keep track of lost and out of order frames */
+  bool first_dl_fn_rcv[8];
+  GSM::Time last_dl_time_rcv[8];
 };

 /** The Transceiver class, responsible for physical layer of basestation */
 class Transceiver {
 public:
  /** Transceiver constructor
-      @param wBasePort base port number of UDP sockets
-      @param TRXAddress IP address of the TRX, as a string
-      @param GSMcoreAddress IP address of the GSM core, as a string
-      @param wSPS number of samples per GSM symbol
+      @param cfg VTY populated config
      @param wTransmitLatency initial setting of transmit latency
      @param radioInterface associated radioInterface object
  */
-  Transceiver(int wBasePort,
-              const char *TRXAddress,
-              const char *GSMcoreAddress,
-              size_t tx_sps, size_t rx_sps, size_t chans,
+  Transceiver(const struct trx_cfg *cfg,
              GSM::Time wTransmitLatency,
-              RadioInterface *wRadioInterface,
-              double wRssiOffset, int stackSize);
+              RadioInterface *wRadioInterface);

  /** Destructor */
  ~Transceiver();

  /** Start the control loop */
-  bool init(FillerType filler, size_t rtsc, unsigned rach_delay,
-            bool edge, bool ext_rach);
+  bool init(void);

  /** attach the radioInterface receive FIFO */
  bool receiveFIFO(VectorFIFO *wFIFO, size_t chan)
@@ -119,7 +125,7 @@ public:
  }

  /** accessor for number of channels */
-  size_t numChans() const { return mChans; };
+  size_t numChans() const { return cfg->num_chans; };

  /** Codes for channel combinations */
  typedef enum {
@@ -142,12 +148,30 @@ public:
  } ChannelCombination;

 private:
-  int mBasePort;
-  std::string mLocalAddr;
-  std::string mRemoteAddr;
+  size_t mChans;
+struct ctrl_msg {
+  char data[101];
+  ctrl_msg() {};
+};

+struct ctrl_sock_state {
+  osmo_fd conn_bfd;
+  std::deque<ctrl_msg> txmsgqueue;
+  ctrl_sock_state() {
+      conn_bfd.fd =  -1;
+  }
+  ~ctrl_sock_state() {
+      if(conn_bfd.fd >= 0) {
+          osmo_fd_unregister(&conn_bfd);
+          close(conn_bfd.fd);
+          conn_bfd.fd = -1;
+      }
+  }
+};
+
+  const struct trx_cfg *cfg;	///< VTY populated config
  std::vector<int> mDataSockets;  ///< socket for writing to/reading from GSM core
-  std::vector<int> mCtrlSockets;  ///< socket for writing/reading control commands from GSM core
+  std::vector<ctrl_sock_state> mCtrlSockets;  ///< socket for writing/reading control commands from GSM core
  int mClockSocket;               ///< socket for writing clock updates to GSM core

  std::vector<VectorQueue> mTxPriorityQueues;   ///< priority queue of transmit bursts received from GSM core
@@ -156,7 +180,6 @@ private:
  std::vector<Thread *> mRxServiceLoopThreads;  ///< thread to pull bursts into receive FIFO
  Thread *mRxLowerLoopThread;                   ///< thread to pull bursts into receive FIFO
  Thread *mTxLowerLoopThread;                   ///< thread to push bursts into transmit FIFO
-  std::vector<Thread *> mControlServiceLoopThreads;         ///< thread to process control messages from GSM core
  std::vector<Thread *> mTxPriorityQueueServiceLoopThreads; ///< thread to process transmit bursts from GSM core

  GSM::Time mTransmitLatency;             ///< latency between basestation clock and transmit deadline clock
@@ -168,9 +191,6 @@ private:
  double txFullScale;                     ///< full scale input to radio
  double rxFullScale;                     ///< full scale output to radio

-  double rssiOffset;                      ///< RSSI to dBm conversion offset
-  int stackSize;                      ///< stack size for threads, 0 = OS default
-
  /** modulate and add a burst to the transmit queue */
  void addRadioVector(size_t chan, BitVector &bits,
                      int RSSI, GSM::Time &wTime);
@@ -193,12 +213,13 @@ private:
  /** send messages over the clock socket */
  bool writeClockInterface(void);

-  int mSPSTx;                          ///< number of samples per Tx symbol
-  int mSPSRx;                          ///< number of samples per Rx symbol
-  size_t mChans;
+  static int ctrl_sock_cb(struct osmo_fd *bfd, unsigned int flags);
+  int ctrl_sock_write(int chan);
+  void ctrl_sock_send(ctrl_msg& m, int chan);
+  /** drive handling of control messages from GSM core */
+  int ctrl_sock_handle_rx(int chan);
+

-  bool mExtRACH;
-  bool mEdge;
  bool mOn;	                           ///< flag to indicate that transceiver is powered on
  bool mForceClockInterface;           ///< flag to indicate whether IND CLOCK shall be sent unconditionally after transceiver is started
  bool mHandover[8][8];                ///< expect handover to the timeslot/subslot
@@ -229,9 +250,6 @@ protected:
  /** drive transmission of GSM bursts */
  void driveTxFIFO();

-  /** drive handling of control messages from GSM core */
-  bool driveControl(size_t chan);
-
  /**
    drive modulation and sorting of GSM bursts from GSM core
    @return true if a burst was transferred successfully
@@ -242,9 +260,8 @@ protected:
  friend void *TxUpperLoopAdapter(TrxChanThParams *params);
  friend void *RxLowerLoopAdapter(Transceiver *transceiver);
  friend void *TxLowerLoopAdapter(Transceiver *transceiver);
-  friend void *ControlServiceLoopAdapter(TrxChanThParams *params);
-

+  double rssiOffset(size_t chan);
  void reset();

  void logRxBurst(size_t chan, const struct trx_ul_burst_ind *bi);
@@ -256,8 +273,5 @@ void *RxUpperLoopAdapter(TrxChanThParams *params);
 void *RxLowerLoopAdapter(Transceiver *transceiver);
 void *TxLowerLoopAdapter(Transceiver *transceiver);

-/** control message handler thread loop */
-void *ControlServiceLoopAdapter(TrxChanThParams *params);
-
 /** transmit queueing thread loop */
 void *TxUpperLoopAdapter(TrxChanThParams *params);
--- a/Transceiver52M/arch/arm/convert.c
+++ b/Transceiver52M/arch/arm/convert.c
@@ -13,10 +13,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #include <malloc.h>
--- a/Transceiver52M/arch/arm/convert_neon.S
+++ b/Transceiver52M/arch/arm/convert_neon.S
@@ -13,10 +13,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 	.syntax unified
--- a/Transceiver52M/arch/arm/convolve.c
+++ b/Transceiver52M/arch/arm/convolve.c
@@ -13,10 +13,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #include <malloc.h>
--- a/Transceiver52M/arch/arm/convolve_neon.S
+++ b/Transceiver52M/arch/arm/convolve_neon.S
@@ -13,10 +13,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #ifdef HAVE_CONFIG_H
--- a/Transceiver52M/arch/arm/mult.c
+++ b/Transceiver52M/arch/arm/mult.c
@@ -13,10 +13,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #include <malloc.h>
--- a/Transceiver52M/arch/arm/mult_neon.S
+++ b/Transceiver52M/arch/arm/mult_neon.S
@@ -13,10 +13,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 	.syntax unified
--- a/Transceiver52M/arch/arm/scale.c
+++ b/Transceiver52M/arch/arm/scale.c
@@ -13,10 +13,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #include <malloc.h>
--- a/Transceiver52M/arch/arm/scale_neon.S
+++ b/Transceiver52M/arch/arm/scale_neon.S
@@ -13,10 +13,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 	.syntax unified
--- a/Transceiver52M/arch/common/convert_base.c
+++ b/Transceiver52M/arch/common/convert_base.c
@@ -13,10 +13,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #include "convert.h"
--- a/Transceiver52M/arch/common/convolve_base.c
+++ b/Transceiver52M/arch/common/convolve_base.c
@@ -13,10 +13,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #include <malloc.h>
--- a/Transceiver52M/arch/x86/convert.c
+++ b/Transceiver52M/arch/x86/convert.c
@@ -11,10 +11,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #include <malloc.h>
--- a/Transceiver52M/arch/x86/convert_sse_3.c
+++ b/Transceiver52M/arch/x86/convert_sse_3.c
@@ -11,10 +11,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #include <malloc.h>
--- a/Transceiver52M/arch/x86/convert_sse_3.h
+++ b/Transceiver52M/arch/x86/convert_sse_3.h
@@ -11,10 +11,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #pragma once
--- a/Transceiver52M/arch/x86/convert_sse_4_1.c
+++ b/Transceiver52M/arch/x86/convert_sse_4_1.c
@@ -11,10 +11,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #include <malloc.h>
--- a/Transceiver52M/arch/x86/convert_sse_4_1.h
+++ b/Transceiver52M/arch/x86/convert_sse_4_1.h
@@ -11,10 +11,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #pragma once
--- a/Transceiver52M/arch/x86/convolve.c
+++ b/Transceiver52M/arch/x86/convolve.c
@@ -11,10 +11,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #include <malloc.h>
@@ -99,9 +95,10 @@ int convolve_real(const float *x, int x_len,
 		  const float *h, int h_len,
 		  float *y, int y_len, int start, int len)
 {
+#ifndef __OPTIMIZE__
 	if (bounds_check(x_len, h_len, y_len, start, len) < 0)
 		return -1;
-
+#endif
 	memset(y, 0, len * 2 * sizeof(float));

 	switch (h_len) {
@@ -138,9 +135,10 @@ int convolve_complex(const float *x, int x_len,
 		     float *y, int y_len,
 		     int start, int len)
 {
+#ifndef __OPTIMIZE__
 	if (bounds_check(x_len, h_len, y_len, start, len) < 0)
 		return -1;
-
+#endif
 	memset(y, 0, len * 2 * sizeof(float));

 	if (!(h_len % 8))
--- a/Transceiver52M/arch/x86/convolve_sse_3.c
+++ b/Transceiver52M/arch/x86/convolve_sse_3.c
@@ -11,10 +11,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #include <malloc.h>
--- a/Transceiver52M/arch/x86/convolve_sse_3.h
+++ b/Transceiver52M/arch/x86/convolve_sse_3.h
@@ -11,10 +11,6 @@
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
 */

 #pragma once
--- a/Transceiver52M/device/Makefile.am
+++ b/Transceiver52M/device/Makefile.am
@@ -2,6 +2,10 @@ include $(top_srcdir)/Makefile.common

 SUBDIRS = common

+if DEVICE_IPC
+SUBDIRS += ipc
+endif
+
 if DEVICE_USRP1
 SUBDIRS += usrp1
 endif
@@ -13,3 +17,7 @@ endif
 if DEVICE_LMS
 SUBDIRS += lms
 endif
+
+if DEVICE_BLADE
+SUBDIRS += bladerf
+endif
--- a/Transceiver52M/device/bladerf/Makefile.am
+++ b/Transceiver52M/device/bladerf/Makefile.am
@@ -0,0 +1,11 @@
+include $(top_srcdir)/Makefile.common
+
+AM_CPPFLAGS = -Wall $(STD_DEFINES_AND_INCLUDES) -I${srcdir}/../common
+AM_CXXFLAGS = -lpthread $(LIBOSMOCORE_CFLAGS) $(LIBOSMOVTY_CFLAGS) $(BLADE_CFLAGS)
+
+noinst_HEADERS = bladerf.h
+
+noinst_LTLIBRARIES = libdevice.la
+
+libdevice_la_SOURCES = bladerf.cpp
+libdevice_la_LIBADD = $(top_builddir)/Transceiver52M/device/common/libdevice_common.la
--- a/Transceiver52M/device/bladerf/bladerf.cpp
+++ b/Transceiver52M/device/bladerf/bladerf.cpp
@@ -0,0 +1,611 @@
+/*
+ * Copyright 2022 sysmocom - s.f.m.c. GmbH
+ *
+ * Author: Eric Wild <ewild@sysmocom.de>
+ *
+ * SPDX-License-Identifier: AGPL-3.0+
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ * See the COPYING file in the main directory for details.
+ */
+
+#include <map>
+#include <libbladeRF.h>
+#include "radioDevice.h"
+#include "bladerf.h"
+#include "Threads.h"
+#include "Logger.h"
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+extern "C" {
+#include <osmocom/core/utils.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/vty/cpu_sched_vty.h>
+}
+
+#define SAMPLE_BUF_SZ (1 << 20)
+
+#define B2XX_TIMING_4_4SPS 6.18462e-5
+
+#define CHKRET()                                                                                                       \
+	{                                                                                                              \
+		if (status != 0)                                                                                       \
+			LOGC(DDEV, ERROR) << bladerf_strerror(status);                                                 \
+	}
+
+static const dev_map_t dev_param_map{
+	{ std::make_tuple(blade_dev_type::BLADE2, 4, 4), { 1, 26e6, GSMRATE, B2XX_TIMING_4_4SPS, "B200 4 SPS" } },
+};
+
+static const power_map_t dev_band_nom_power_param_map{
+	{ std::make_tuple(blade_dev_type::BLADE2, GSM_BAND_850), { 89.75, 13.3, -7.5 } },
+	{ std::make_tuple(blade_dev_type::BLADE2, GSM_BAND_900), { 89.75, 13.3, -7.5 } },
+	{ std::make_tuple(blade_dev_type::BLADE2, GSM_BAND_1800), { 89.75, 7.5, -11.0 } },
+	{ std::make_tuple(blade_dev_type::BLADE2, GSM_BAND_1900), { 89.75, 7.7, -11.0 } },
+};
+
+/* So far measurements done for B210 show really close to linear relationship
+ * between gain and real output power, so we simply adjust the measured offset
+ */
+static double TxGain2TxPower(const dev_band_desc &desc, double tx_gain_db)
+{
+	return desc.nom_out_tx_power - (desc.nom_uhd_tx_gain - tx_gain_db);
+}
+static double TxPower2TxGain(const dev_band_desc &desc, double tx_power_dbm)
+{
+	return desc.nom_uhd_tx_gain - (desc.nom_out_tx_power - tx_power_dbm);
+}
+
+blade_device::blade_device(InterfaceType iface, const struct trx_cfg *cfg)
+	: RadioDevice(iface, cfg), band_manager(dev_band_nom_power_param_map, dev_param_map), dev(nullptr),
+	  rx_gain_min(0.0), rx_gain_max(0.0), tx_spp(0), rx_spp(0), started(false), aligned(false), drop_cnt(0),
+	  prev_ts(0), ts_initial(0), ts_offset(0), async_event_thrd(NULL)
+{
+}
+
+blade_device::~blade_device()
+{
+	if (dev) {
+		bladerf_enable_module(dev, BLADERF_CHANNEL_RX(0), false);
+		bladerf_enable_module(dev, BLADERF_CHANNEL_TX(0), false);
+	}
+
+	stop();
+
+	for (size_t i = 0; i < rx_buffers.size(); i++)
+		delete rx_buffers[i];
+}
+
+void blade_device::init_gains()
+{
+	double tx_gain_min, tx_gain_max;
+	int status;
+
+	const struct bladerf_range *r;
+	bladerf_get_gain_range(dev, BLADERF_RX, &r);
+
+	rx_gain_min = r->min;
+	rx_gain_max = r->max;
+	LOGC(DDEV, INFO) << "Supported Rx gain range [" << rx_gain_min << "; " << rx_gain_max << "]";
+
+	for (size_t i = 0; i < rx_gains.size(); i++) {
+		double gain = (rx_gain_min + rx_gain_max) / 2;
+		status = bladerf_set_gain_mode(dev, BLADERF_CHANNEL_RX(i), BLADERF_GAIN_MGC);
+		CHKRET()
+		bladerf_gain_mode m;
+		bladerf_get_gain_mode(dev, BLADERF_CHANNEL_RX(i), &m);
+		LOGC(DDEV, INFO) << (m == BLADERF_GAIN_MANUAL ? "gain manual" : "gain AUTO");
+
+		status = bladerf_set_gain(dev, BLADERF_CHANNEL_RX(i), 0);
+		CHKRET()
+		int actual_gain;
+		status = bladerf_get_gain(dev, BLADERF_CHANNEL_RX(i), &actual_gain);
+		CHKRET()
+		LOGC(DDEV, INFO) << "Default setting Rx gain for channel " << i << " to " << gain << " scale "
+				 << r->scale << " actual " << actual_gain;
+		rx_gains[i] = actual_gain;
+
+		status = bladerf_set_gain(dev, BLADERF_CHANNEL_RX(i), 0);
+		CHKRET()
+		status = bladerf_get_gain(dev, BLADERF_CHANNEL_RX(i), &actual_gain);
+		CHKRET()
+		LOGC(DDEV, INFO) << "Default setting Rx gain for channel " << i << " to " << gain << " scale "
+				 << r->scale << " actual " << actual_gain;
+		rx_gains[i] = actual_gain;
+	}
+
+	status = bladerf_get_gain_range(dev, BLADERF_TX, &r);
+	CHKRET()
+	tx_gain_min = r->min;
+	tx_gain_max = r->max;
+	LOGC(DDEV, INFO) << "Supported Tx gain range [" << tx_gain_min << "; " << tx_gain_max << "]";
+
+	for (size_t i = 0; i < tx_gains.size(); i++) {
+		double gain = (tx_gain_min + tx_gain_max) / 2;
+		status = bladerf_set_gain(dev, BLADERF_CHANNEL_TX(i), 30);
+		CHKRET()
+		int actual_gain;
+		status = bladerf_get_gain(dev, BLADERF_CHANNEL_TX(i), &actual_gain);
+		CHKRET()
+		LOGC(DDEV, INFO) << "Default setting Tx gain for channel " << i << " to " << gain << " scale "
+				 << r->scale << " actual " << actual_gain;
+		tx_gains[i] = actual_gain;
+	}
+
+	return;
+}
+
+void blade_device::set_rates()
+{
+	struct bladerf_rational_rate rate = { 0, static_cast<uint64_t>((1625e3 * 4)), 6 }, actual;
+	auto status = bladerf_set_rational_sample_rate(dev, BLADERF_CHANNEL_RX(0), &rate, &actual);
+	CHKRET()
+	status = bladerf_set_rational_sample_rate(dev, BLADERF_CHANNEL_TX(0), &rate, &actual);
+	CHKRET()
+
+	tx_rate = rx_rate = (double)rate.num / (double)rate.den;
+
+	LOGC(DDEV, INFO) << "Rates set to" << tx_rate << " / " << rx_rate;
+
+	bladerf_set_bandwidth(dev, BLADERF_CHANNEL_RX(0), (bladerf_bandwidth)2e6, (bladerf_bandwidth *)NULL);
+	bladerf_set_bandwidth(dev, BLADERF_CHANNEL_TX(0), (bladerf_bandwidth)2e6, (bladerf_bandwidth *)NULL);
+
+	ts_offset = 60; // FIXME: actual blade offset, should equal b2xx
+}
+
+double blade_device::setRxGain(double db, size_t chan)
+{
+	if (chan >= rx_gains.size()) {
+		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
+		return 0.0f;
+	}
+
+	bladerf_set_gain(dev, BLADERF_CHANNEL_RX(chan), 30); //db);
+	int actual_gain;
+	bladerf_get_gain(dev, BLADERF_CHANNEL_RX(chan), &actual_gain);
+
+	rx_gains[chan] = actual_gain;
+
+	LOGC(DDEV, INFO) << "Set RX gain to " << rx_gains[chan] << "dB (asked for " << db << "dB)";
+
+	return rx_gains[chan];
+}
+
+double blade_device::getRxGain(size_t chan)
+{
+	if (chan >= rx_gains.size()) {
+		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
+		return 0.0f;
+	}
+
+	return rx_gains[chan];
+}
+
+double blade_device::rssiOffset(size_t chan)
+{
+	double rssiOffset;
+	dev_band_desc desc;
+
+	if (chan >= rx_gains.size()) {
+		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
+		return 0.0f;
+	}
+
+	get_dev_band_desc(desc);
+	rssiOffset = rx_gains[chan] + desc.rxgain2rssioffset_rel;
+	return rssiOffset;
+}
+
+double blade_device::setPowerAttenuation(int atten, size_t chan)
+{
+	double tx_power, db;
+	dev_band_desc desc;
+
+	if (chan >= tx_gains.size()) {
+		LOGC(DDEV, ALERT) << "Requested non-existent channel" << chan;
+		return 0.0f;
+	}
+
+	get_dev_band_desc(desc);
+	tx_power = desc.nom_out_tx_power - atten;
+	db = TxPower2TxGain(desc, tx_power);
+
+	bladerf_set_gain(dev, BLADERF_CHANNEL_TX(chan), 30);
+	int actual_gain;
+	bladerf_get_gain(dev, BLADERF_CHANNEL_RX(chan), &actual_gain);
+
+	tx_gains[chan] = actual_gain;
+
+	LOGC(DDEV, INFO)
+		<< "Set TX gain to " << tx_gains[chan] << "dB, ~" << TxGain2TxPower(desc, tx_gains[chan]) << " dBm "
+		<< "(asked for " << db << " dB, ~" << tx_power << " dBm)";
+
+	return desc.nom_out_tx_power - TxGain2TxPower(desc, tx_gains[chan]);
+}
+double blade_device::getPowerAttenuation(size_t chan)
+{
+	dev_band_desc desc;
+	if (chan >= tx_gains.size()) {
+		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
+		return 0.0f;
+	}
+
+	get_dev_band_desc(desc);
+	return desc.nom_out_tx_power - TxGain2TxPower(desc, tx_gains[chan]);
+}
+
+int blade_device::getNominalTxPower(size_t chan)
+{
+	dev_band_desc desc;
+	get_dev_band_desc(desc);
+
+	return desc.nom_out_tx_power;
+}
+
+int blade_device::open()
+{
+	bladerf_log_set_verbosity(BLADERF_LOG_LEVEL_VERBOSE);
+	bladerf_set_usb_reset_on_open(true);
+	auto success = bladerf_open(&dev, cfg->dev_args);
+	if (success != 0) {
+		struct bladerf_devinfo *info;
+		auto num_devs = bladerf_get_device_list(&info);
+		LOGC(DDEV, ALERT) << "No bladerf devices found with identifier '" << cfg->dev_args << "'";
+		if (num_devs) {
+			for (int i = 0; i < num_devs; i++)
+				LOGC(DDEV, ALERT) << "Found device:" << info[i].product << " serial " << info[i].serial;
+		}
+
+		return -1;
+	}
+	if (strcmp("bladerf2", bladerf_get_board_name(dev))) {
+		LOGC(DDEV, ALERT) << "Only BladeRF2 supported! found:" << bladerf_get_board_name(dev);
+		return -1;
+	}
+
+	dev_type = blade_dev_type::BLADE2;
+	tx_window = TX_WINDOW_FIXED;
+	update_band_dev(dev_key(dev_type, tx_sps, rx_sps));
+
+	struct bladerf_devinfo info;
+	bladerf_get_devinfo(dev, &info);
+	LOGC(DDEV, INFO) << "Using discovered bladerf device " << info.serial;
+
+	tx_freqs.resize(chans);
+	rx_freqs.resize(chans);
+	tx_gains.resize(chans);
+	rx_gains.resize(chans);
+	rx_buffers.resize(chans);
+
+	switch (cfg->clock_ref) {
+	case REF_INTERNAL:
+	case REF_EXTERNAL:
+		break;
+	default:
+		LOGC(DDEV, ALERT) << "Invalid reference type";
+		return -1;
+	}
+
+	if (cfg->clock_ref == REF_EXTERNAL) {
+		bool is_locked;
+		int status = bladerf_set_pll_enable(dev, true);
+		CHKRET()
+		status = bladerf_set_pll_refclk(dev, 10000000);
+		CHKRET()
+		for (int i = 0; i < 20; i++) {
+			usleep(50 * 1000);
+			status = bladerf_get_pll_lock_state(dev, &is_locked);
+			CHKRET()
+			if (is_locked)
+				break;
+		}
+		if (!is_locked) {
+			LOGC(DDEV, ALERT) << "unable to lock refclk!";
+			return -1;
+		}
+	}
+
+	LOGC(DDEV, INFO)
+		<< "Selected clock source is " << ((cfg->clock_ref == REF_INTERNAL) ? "internal" : "external 10Mhz");
+
+	set_rates();
+
+	/*
+	1ts = 3/5200s
+	1024*2 = small gap(~180us) every 9.23ms = every 16 ts? -> every 2 frames
+	1024*1 = large gap(~627us) every 9.23ms = every 16 ts? -> every 2 frames
+
+	rif convertbuffer = 625*4 = 2500 -> 4 ts
+	rif rxtxbuf = 4 * segment(625*4) = 10000 -> 16 ts
+	*/
+	const unsigned int num_buffers = 256;
+	const unsigned int buffer_size = 1024 * 4; /* Must be a multiple of 1024 */
+	const unsigned int num_transfers = 32;
+	const unsigned int timeout_ms = 3500;
+
+	bladerf_sync_config(dev, BLADERF_RX_X1, BLADERF_FORMAT_SC16_Q11_META, num_buffers, buffer_size, num_transfers,
+			    timeout_ms);
+
+	bladerf_sync_config(dev, BLADERF_TX_X1, BLADERF_FORMAT_SC16_Q11_META, num_buffers, buffer_size, num_transfers,
+			    timeout_ms);
+
+	/* Number of samples per over-the-wire packet */
+	tx_spp = rx_spp = buffer_size;
+
+	size_t buf_len = SAMPLE_BUF_SZ / sizeof(uint32_t);
+	for (size_t i = 0; i < rx_buffers.size(); i++)
+		rx_buffers[i] = new smpl_buf(buf_len);
+
+	pkt_bufs = std::vector<std::vector<short> >(chans, std::vector<short>(2 * rx_spp));
+	for (size_t i = 0; i < pkt_bufs.size(); i++)
+		pkt_ptrs.push_back(&pkt_bufs[i].front());
+
+	init_gains();
+
+	return NORMAL;
+}
+
+bool blade_device::restart()
+{
+	/* Allow 100 ms delay to align multi-channel streams */
+	double delay = 0.2;
+	int status;
+
+	status = bladerf_enable_module(dev, BLADERF_CHANNEL_RX(0), true);
+	CHKRET()
+	status = bladerf_enable_module(dev, BLADERF_CHANNEL_TX(0), true);
+	CHKRET()
+
+	bladerf_timestamp now;
+	status = bladerf_get_timestamp(dev, BLADERF_RX, &now);
+	ts_initial = now + rx_rate * delay;
+	LOGC(DDEV, INFO) << "Initial timestamp " << ts_initial << std::endl;
+
+	return true;
+}
+
+bool blade_device::start()
+{
+	LOGC(DDEV, INFO) << "Starting USRP...";
+
+	if (started) {
+		LOGC(DDEV, ERROR) << "Device already started";
+		return false;
+	}
+
+	if (!restart())
+		return false;
+
+	started = true;
+	return true;
+}
+
+bool blade_device::stop()
+{
+	if (!started)
+		return false;
+
+	/* reset internal buffer timestamps */
+	for (size_t i = 0; i < rx_buffers.size(); i++)
+		rx_buffers[i]->reset();
+
+	band_reset();
+
+	started = false;
+	return true;
+}
+
+int blade_device::readSamples(std::vector<short *> &bufs, int len, bool *overrun, TIMESTAMP timestamp, bool *underrun)
+{
+	ssize_t rc;
+	uint64_t ts;
+
+	if (bufs.size() != chans) {
+		LOGC(DDEV, ALERT) << "Invalid channel combination " << bufs.size();
+		return -1;
+	}
+
+	*overrun = false;
+	*underrun = false;
+
+	// Shift read time with respect to transmit clock
+	timestamp += ts_offset;
+
+	ts = timestamp;
+	LOGC(DDEV, DEBUG) << "Requested timestamp = " << ts;
+
+	// Check that timestamp is valid
+	rc = rx_buffers[0]->avail_smpls(timestamp);
+	if (rc < 0) {
+		LOGC(DDEV, ERROR) << rx_buffers[0]->str_code(rc);
+		LOGC(DDEV, ERROR) << rx_buffers[0]->str_status(timestamp);
+		return 0;
+	}
+
+	struct bladerf_metadata meta = {};
+	meta.timestamp = ts;
+
+	while (rx_buffers[0]->avail_smpls(timestamp) < len) {
+		thread_enable_cancel(false);
+		int status = bladerf_sync_rx(dev, pkt_ptrs[0], len, &meta, 200U);
+		thread_enable_cancel(true);
+
+		if (status != 0)
+			LOGC(DDEV, ERROR) << "RX broken: " << bladerf_strerror(status);
+		if (meta.flags & BLADERF_META_STATUS_OVERRUN)
+			LOGC(DDEV, ERROR) << "RX borken, OVERRUN: " << bladerf_strerror(status);
+
+		size_t num_smpls = meta.actual_count;
+		;
+		ts = meta.timestamp;
+
+		for (size_t i = 0; i < rx_buffers.size(); i++) {
+			rc = rx_buffers[i]->write((short *)&pkt_bufs[i].front(), num_smpls, ts);
+
+			// Continue on local overrun, exit on other errors
+			if ((rc < 0)) {
+				LOGC(DDEV, ERROR) << rx_buffers[i]->str_code(rc);
+				LOGC(DDEV, ERROR) << rx_buffers[i]->str_status(timestamp);
+				if (rc != smpl_buf::ERROR_OVERFLOW)
+					return 0;
+			}
+		}
+		meta = {};
+		meta.timestamp = ts + num_smpls;
+	}
+
+	for (size_t i = 0; i < rx_buffers.size(); i++) {
+		rc = rx_buffers[i]->read(bufs[i], len, timestamp);
+		if ((rc < 0) || (rc != len)) {
+			LOGC(DDEV, ERROR) << rx_buffers[i]->str_code(rc);
+			LOGC(DDEV, ERROR) << rx_buffers[i]->str_status(timestamp);
+			return 0;
+		}
+	}
+
+	return len;
+}
+
+int blade_device::writeSamples(std::vector<short *> &bufs, int len, bool *underrun, unsigned long long timestamp)
+{
+	*underrun = false;
+	static bool first_tx = true;
+	struct bladerf_metadata meta = {};
+	if (first_tx) {
+		meta.timestamp = timestamp;
+		meta.flags = BLADERF_META_FLAG_TX_BURST_START;
+		first_tx = false;
+	}
+
+	thread_enable_cancel(false);
+	int status = bladerf_sync_tx(dev, (const void *)bufs[0], len, &meta, 200U);
+	thread_enable_cancel(true);
+
+	if (status != 0)
+		LOGC(DDEV, ERROR) << "TX broken: " << bladerf_strerror(status);
+
+	return len;
+}
+
+bool blade_device::updateAlignment(TIMESTAMP timestamp)
+{
+	return true;
+}
+
+bool blade_device::set_freq(double freq, size_t chan, bool tx)
+{
+	if (tx) {
+		bladerf_set_frequency(dev, BLADERF_CHANNEL_TX(chan), freq);
+		bladerf_frequency f;
+		bladerf_get_frequency(dev, BLADERF_CHANNEL_TX(chan), &f);
+		tx_freqs[chan] = f;
+	} else {
+		bladerf_set_frequency(dev, BLADERF_CHANNEL_RX(chan), freq);
+		bladerf_frequency f;
+		bladerf_get_frequency(dev, BLADERF_CHANNEL_RX(chan), &f);
+		rx_freqs[chan] = f;
+	}
+	LOGCHAN(chan, DDEV, INFO) << "set_freq(" << freq << ", " << (tx ? "TX" : "RX") << "): " << std::endl;
+
+	return true;
+}
+
+bool blade_device::setTxFreq(double wFreq, size_t chan)
+{
+	if (chan >= tx_freqs.size()) {
+		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
+		return false;
+	}
+	ScopedLock lock(tune_lock);
+
+	if (!update_band_from_freq(wFreq, chan, true))
+		return false;
+
+	if (!set_freq(wFreq, chan, true))
+		return false;
+
+	return true;
+}
+
+bool blade_device::setRxFreq(double wFreq, size_t chan)
+{
+	if (chan >= rx_freqs.size()) {
+		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
+		return false;
+	}
+	ScopedLock lock(tune_lock);
+
+	if (!update_band_from_freq(wFreq, chan, false))
+		return false;
+
+	return set_freq(wFreq, chan, false);
+}
+
+double blade_device::getTxFreq(size_t chan)
+{
+	if (chan >= tx_freqs.size()) {
+		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
+		return 0.0;
+	}
+
+	return tx_freqs[chan];
+}
+
+double blade_device::getRxFreq(size_t chan)
+{
+	if (chan >= rx_freqs.size()) {
+		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
+		return 0.0;
+	}
+
+	return rx_freqs[chan];
+}
+
+bool blade_device::requiresRadioAlign()
+{
+	return false;
+}
+
+GSM::Time blade_device::minLatency()
+{
+	return GSM::Time(6, 7);
+}
+
+TIMESTAMP blade_device::initialWriteTimestamp()
+{
+	return ts_initial;
+}
+
+TIMESTAMP blade_device::initialReadTimestamp()
+{
+	return ts_initial;
+}
+
+double blade_device::fullScaleInputValue()
+{
+	return (double)2047;
+}
+
+double blade_device::fullScaleOutputValue()
+{
+	return (double)2047;
+}
+
+RadioDevice *RadioDevice::make(InterfaceType type, const struct trx_cfg *cfg)
+{
+	return new blade_device(type, cfg);
+}
--- a/Transceiver52M/device/bladerf/bladerf.h
+++ b/Transceiver52M/device/bladerf/bladerf.h
@@ -0,0 +1,195 @@
+/*
+ * Copyright 2022 sysmocom - s.f.m.c. GmbH
+ *
+ * Author: Eric Wild <ewild@sysmocom.de>
+ *
+ * SPDX-License-Identifier: AGPL-3.0+
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ * See the COPYING file in the main directory for details.
+ */
+
+#pragma once
+
+#include <map>
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "bandmanager.h"
+#include "radioDevice.h"
+#include "smpl_buf.h"
+
+extern "C" {
+#include <osmocom/gsm/gsm_utils.h>
+}
+
+enum class blade_dev_type { BLADE1, BLADE2 };
+
+struct dev_band_desc {
+	/* Maximum UHD Tx Gain which can be set/used without distorting the
+	   output signal, and the resulting real output power measured when that
+	   gain is used. Correct measured values only provided for B210 so far. */
+	double nom_uhd_tx_gain; /* dB */
+	double nom_out_tx_power; /* dBm */
+	/* Factor used to infer base real RSSI offset on the Rx path based on current
+	   configured RxGain. The resulting rssiOffset is added to the per burst
+	   calculated energy in upper layers. These values were empirically
+	   found and may change based on multiple factors, see OS#4468.
+	   rssiOffset = rxGain + rxgain2rssioffset_rel;
+	*/
+	double rxgain2rssioffset_rel; /* dB */
+};
+
+/* Device parameter descriptor */
+struct dev_desc {
+	unsigned channels;
+	double mcr;
+	double rate;
+	double offset;
+	std::string desc_str;
+};
+
+using dev_key = std::tuple<blade_dev_type, int, int>;
+using dev_band_key = std::tuple<blade_dev_type, enum gsm_band>;
+using power_map_t = std::map<dev_band_key, dev_band_desc>;
+using dev_map_t = std::map<dev_key, dev_desc>;
+
+class blade_device : public RadioDevice, public band_manager<power_map_t, dev_map_t> {
+    public:
+	blade_device(InterfaceType iface, const struct trx_cfg *cfg);
+	~blade_device();
+
+	int open();
+	bool start();
+	bool stop();
+	bool restart();
+	enum TxWindowType getWindowType()
+	{
+		return tx_window;
+	}
+
+	int readSamples(std::vector<short *> &bufs, int len, bool *overrun, TIMESTAMP timestamp, bool *underrun);
+
+	int writeSamples(std::vector<short *> &bufs, int len, bool *underrun, TIMESTAMP timestamp);
+
+	bool updateAlignment(TIMESTAMP timestamp);
+
+	bool setTxFreq(double wFreq, size_t chan);
+	bool setRxFreq(double wFreq, size_t chan);
+
+	TIMESTAMP initialWriteTimestamp();
+	TIMESTAMP initialReadTimestamp();
+
+	double fullScaleInputValue();
+	double fullScaleOutputValue();
+
+	double setRxGain(double db, size_t chan);
+	double getRxGain(size_t chan);
+	double maxRxGain(void)
+	{
+		return rx_gain_max;
+	}
+	double minRxGain(void)
+	{
+		return rx_gain_min;
+	}
+	double rssiOffset(size_t chan);
+
+	double setPowerAttenuation(int atten, size_t chan);
+	double getPowerAttenuation(size_t chan = 0);
+
+	int getNominalTxPower(size_t chan = 0);
+
+	double getTxFreq(size_t chan);
+	double getRxFreq(size_t chan);
+	double getRxFreq();
+
+	bool setRxAntenna(const std::string &ant, size_t chan)
+	{
+		return {};
+	};
+	std::string getRxAntenna(size_t chan)
+	{
+		return {};
+	};
+	bool setTxAntenna(const std::string &ant, size_t chan)
+	{
+		return {};
+	};
+	std::string getTxAntenna(size_t chan)
+	{
+		return {};
+	};
+
+	bool requiresRadioAlign();
+
+	GSM::Time minLatency();
+
+	inline double getSampleRate()
+	{
+		return tx_rate;
+	}
+
+	/** Receive and process asynchronous message
+	    @return true if message received or false on timeout or error
+	*/
+	bool recv_async_msg();
+
+	enum err_code {
+		ERROR_TIMING = -1,
+		ERROR_TIMEOUT = -2,
+		ERROR_UNRECOVERABLE = -3,
+		ERROR_UNHANDLED = -4,
+	};
+
+    protected:
+	struct bladerf *dev;
+	void *usrp_dev;
+
+	enum TxWindowType tx_window;
+	enum blade_dev_type dev_type;
+
+	double tx_rate, rx_rate;
+
+	double rx_gain_min, rx_gain_max;
+
+	std::vector<double> tx_gains, rx_gains;
+	std::vector<double> tx_freqs, rx_freqs;
+	size_t tx_spp, rx_spp;
+
+	bool started;
+	bool aligned;
+
+	size_t drop_cnt;
+	uint64_t prev_ts;
+
+	TIMESTAMP ts_initial, ts_offset;
+	std::vector<smpl_buf *> rx_buffers;
+	/* Sample buffers used to receive samples: */
+	std::vector<std::vector<short> > pkt_bufs;
+	/* Used to call UHD API: Buffer pointer of each elem in pkt_ptrs will
+	   point to corresponding buffer of vector pkt_bufs. */
+	std::vector<short *> pkt_ptrs;
+
+	void init_gains();
+	void set_channels(bool swap);
+	void set_rates();
+	bool flush_recv(size_t num_pkts);
+
+	bool set_freq(double freq, size_t chan, bool tx);
+
+	Thread *async_event_thrd;
+	Mutex tune_lock;
+};
--- a/Transceiver52M/device/common/Makefile.am
+++ b/Transceiver52M/device/common/Makefile.am
@@ -1,10 +1,10 @@
 include $(top_srcdir)/Makefile.common

 AM_CPPFLAGS = -Wall $(STD_DEFINES_AND_INCLUDES)
-AM_CXXFLAGS = -lpthread $(LIBOSMOCORE_CFLAGS) $(LIBOSMOCTRL_CFLAGS) $(LIBOSMOVTY_CFLAGS) $(LMS_CFLAGS)
+AM_CXXFLAGS = -lpthread $(LIBOSMOCORE_CFLAGS)


-noinst_HEADERS = radioDevice.h smpl_buf.h
+noinst_HEADERS = radioDevice.h smpl_buf.h bandmanager.h

 noinst_LTLIBRARIES = libdevice_common.la

--- a/Transceiver52M/device/common/bandmanager.h
+++ b/Transceiver52M/device/common/bandmanager.h
@@ -0,0 +1,137 @@
+#pragma once
+/*
+ * (C) 2022 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved
+ *
+ * Author: Eric Wild <ewild@sysmocom.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <string>
+#include <tuple>
+
+#include "Logger.h"
+
+extern "C" {
+#include <osmocom/gsm/gsm_utils.h>
+}
+
+template <typename powermapt, typename devmapt>
+class band_manager {
+	using powerkeyt = typename powermapt::key_type;
+	using powermappedt = typename powermapt::mapped_type;
+	using devkeyt = typename devmapt::key_type;
+	devkeyt m_dev_type;
+	const powermapt &m_power_map;
+	const devmapt &m_dev_map;
+	powerkeyt m_fallback;
+	enum gsm_band m_band;
+	powermappedt m_band_desc;
+	bool band_ass_curr_sess{}; /* true if  "band" was set after last POWEROFF */
+
+	// looks up either first tuple element (->enum) or straight enum
+	template <typename T, typename std::enable_if<std::is_enum<T>::value>::type *dummy = nullptr>
+	auto key_helper(T &t) -> T
+	{
+		return t;
+	}
+
+	template <typename T>
+	auto key_helper(T t) -> typename std::tuple_element<0, T>::type
+	{
+		return std::get<0>(t);
+	}
+
+	void assign_band_desc(enum gsm_band req_band)
+	{
+		auto key = key_helper(m_dev_type);
+		auto fallback_key = key_helper(m_fallback);
+		auto it = m_power_map.find({ key, req_band });
+		if (it == m_power_map.end()) {
+			auto desc = m_dev_map.at(m_dev_type);
+			LOGC(DDEV, ERROR) << "No Tx Power measurements exist for device " << desc.desc_str
+					  << " on band " << gsm_band_name(req_band) << ", using fallback..";
+			it = m_power_map.find({ fallback_key, req_band });
+		}
+		OSMO_ASSERT(it != m_power_map.end());
+		m_band_desc = it->second;
+	}
+
+	bool set_band(enum gsm_band req_band)
+	{
+		if (band_ass_curr_sess && req_band != m_band) {
+			LOGC(DDEV, ALERT) << "Requesting band " << gsm_band_name(req_band)
+					  << " different from previous band " << gsm_band_name(m_band);
+			return false;
+		}
+
+		if (req_band != m_band) {
+			m_band = req_band;
+			assign_band_desc(m_band);
+		}
+		band_ass_curr_sess = true;
+		return true;
+	}
+
+    public:
+	band_manager(const devkeyt &dev_type, const powermapt &power_map, const devmapt &dev_map, powerkeyt fallback)
+		: m_dev_type(dev_type), m_power_map(power_map), m_dev_map(dev_map), m_fallback(fallback),
+		  m_band((enum gsm_band)0)
+	{
+	}
+	band_manager(const powermapt &power_map, const devmapt &dev_map)
+		: m_dev_type(dev_map.begin()->first), m_power_map(power_map), m_dev_map(dev_map),
+		  m_fallback(m_power_map.begin()->first), m_band((enum gsm_band)0)
+	{
+	}
+	void band_reset()
+	{
+		band_ass_curr_sess = false;
+	}
+
+	void update_band_dev(devkeyt dev_type) {
+		m_dev_type = dev_type;
+	}
+
+	void get_dev_band_desc(powermappedt &desc)
+	{
+		if (m_band == 0) {
+			LOGC(DDEV, ERROR)
+				<< "Power parameters requested before Tx Frequency was set! Providing band 900 by default...";
+			assign_band_desc(GSM_BAND_900);
+		}
+		desc = m_band_desc;
+	}
+
+	bool update_band_from_freq(double wFreq, int chan, bool is_tx)
+	{
+		enum gsm_band req_band;
+		auto dirstr = is_tx ? "Tx" : "Rx";
+		auto req_arfcn = gsm_freq102arfcn(wFreq / 1000 / 100, !is_tx);
+		if (req_arfcn == 0xffff) {
+			LOGCHAN(chan, DDEV, ALERT)
+				<< "Unknown ARFCN for " << dirstr << " Frequency " << wFreq / 1000 << " kHz";
+			return false;
+		}
+		if (gsm_arfcn2band_rc(req_arfcn, &req_band) < 0) {
+			LOGCHAN(chan, DDEV, ALERT) << "Unknown GSM band for " << dirstr << " Frequency " << wFreq
+						   << " Hz (ARFCN " << req_arfcn << " )";
+			return false;
+		}
+
+		return set_band(req_band);
+	}
+};
--- a/Transceiver52M/device/common/radioDevice.h
+++ b/Transceiver52M/device/common/radioDevice.h
@@ -51,13 +51,10 @@ class RadioDevice {
    MULTI_ARFCN,
  };

-  static RadioDevice *make(size_t tx_sps, size_t rx_sps, InterfaceType type,
-                           size_t chans = 1, double offset = 0.0,
-                           const std::vector<std::string>& tx_paths = std::vector<std::string>(1, ""),
-                           const std::vector<std::string>& rx_paths = std::vector<std::string>(1, ""));
+  static RadioDevice *make(InterfaceType type, const struct trx_cfg *cfg);

  /** Initialize the USRP */
-  virtual int open(const std::string &args, int ref, bool swap_channels)=0;
+  virtual int open() = 0;

  virtual ~RadioDevice() { }

@@ -125,17 +122,11 @@ class RadioDevice {
  /** return minimum Rx Gain **/
  virtual double minRxGain(void) = 0;

-  /** sets the transmit chan gain, returns the gain setting **/
-  virtual double setTxGain(double dB, size_t chan = 0) = 0;
+  /** return base RSSI offset to apply for received samples **/
+  virtual double rssiOffset(size_t chan) = 0;

-  /** get transmit gain */
-  virtual double getTxGain(size_t chan = 0) = 0;
-
-  /** return maximum Tx Gain **/
-  virtual double maxTxGain(void) = 0;
-
-  /** return minimum Tx Gain **/
-  virtual double minTxGain(void) = 0;
+  /** returns the Nominal transmit output power of the transceiver in dBm, negative on error **/
+  virtual int getNominalTxPower(size_t chan = 0) = 0;

  /** sets the RX path to use, returns true if successful and false otherwise */
  virtual bool setRxAntenna(const std::string &ant, size_t chan = 0) = 0;
@@ -160,6 +151,9 @@ class RadioDevice {
  virtual double getRxFreq(size_t chan = 0) = 0;
  virtual double getSampleRate()=0;

+  virtual double setPowerAttenuation(int atten, size_t chan) = 0;
+  virtual double getPowerAttenuation(size_t chan=0) = 0;
+
  protected:
  size_t tx_sps, rx_sps;
  InterfaceType iface;
@@ -167,24 +161,30 @@ class RadioDevice {
  double lo_offset;
  std::vector<std::string> tx_paths, rx_paths;
  std::vector<struct device_counters> m_ctr;
+  const struct trx_cfg *cfg;

-  RadioDevice(size_t tx_sps, size_t rx_sps, InterfaceType type, size_t chan_num, double offset,
-              const std::vector<std::string>& tx_paths,
-              const std::vector<std::string>& rx_paths):
-		tx_sps(tx_sps), rx_sps(rx_sps), iface(type), chans(chan_num), lo_offset(offset),
-		tx_paths(tx_paths), rx_paths(rx_paths)
-	{
-		if (iface == MULTI_ARFCN) {
-			LOGC(DDEV, INFO) << "Multi-ARFCN: "<< chan_num << " logical chans -> 1 physical chans";
-			chans = 1;
-		}
+#define charp2str(a) ((a) ? std::string(a) : std::string(""))

-		m_ctr.resize(chans);
-		for (size_t i = 0; i < chans; i++) {
-			memset(&m_ctr[i], 0, sizeof(m_ctr[i]));
-			m_ctr[i].chan = i;
-		}
-	}
+  RadioDevice(InterfaceType type, const struct trx_cfg *cfg)
+	  : tx_sps(cfg->tx_sps), rx_sps(cfg->rx_sps), iface(type), chans(cfg->num_chans), lo_offset(cfg->offset),
+	    m_ctr(chans), cfg(cfg)
+  {
+	  /* Generate vector of rx/tx_path: */
+	  for (unsigned int i = 0; i < cfg->num_chans; i++) {
+		  rx_paths.push_back(charp2str(cfg->chans[i].rx_path));
+		  tx_paths.push_back(charp2str(cfg->chans[i].tx_path));
+	  }
+
+	  if (iface == MULTI_ARFCN) {
+		  LOGC(DDEV, INFO) << "Multi-ARFCN: " << chans << " logical chans -> 1 physical chans";
+		  chans = 1;
+	  }
+
+	  for (size_t i = 0; i < chans; i++) {
+		  memset(&m_ctr[i], 0, sizeof(m_ctr[i]));
+		  m_ctr[i].chan = i;
+	  }
+  }

  bool set_antennas() {
 	unsigned int i;
@@ -192,6 +192,13 @@ class RadioDevice {
 	for (i = 0; i < tx_paths.size(); i++) {
 		if (tx_paths[i] == "")
 			continue;
+		if (iface == MULTI_ARFCN && i > 0) {
+			LOGCHAN(i, DDEV, NOTICE) << "Not setting Tx antenna "
+						 << tx_paths[i]
+						 << " for a logical channel";
+			continue;
+		}
+
 		LOGCHAN(i, DDEV, DEBUG) << "Configuring Tx antenna " << tx_paths[i];
 		if (!setTxAntenna(tx_paths[i], i)) {
 			LOGCHAN(i, DDEV, ALERT) << "Failed configuring Tx antenna " << tx_paths[i];
@@ -202,6 +209,13 @@ class RadioDevice {
 	for (i = 0; i < rx_paths.size(); i++) {
 		if (rx_paths[i] == "")
 			continue;
+		if (iface == MULTI_ARFCN && i > 0) {
+			LOGCHAN(i, DDEV, NOTICE) << "Not setting Rx antenna "
+						 << rx_paths[i]
+						 << " for a logical channel";
+			continue;
+		}
+
 		LOGCHAN(i, DDEV, DEBUG) << "Configuring Rx antenna " << rx_paths[i];
 		if (!setRxAntenna(rx_paths[i], i)) {
 			LOGCHAN(i, DDEV, ALERT) << "Failed configuring Rx antenna " << rx_paths[i];
--- a/Transceiver52M/device/common/smpl_buf.cpp
+++ b/Transceiver52M/device/common/smpl_buf.cpp
@@ -28,9 +28,9 @@
 #include <inttypes.h>

 smpl_buf::smpl_buf(size_t len)
-	: buf_len(len), time_start(0), time_end(0),
-	  data_start(0), data_end(0)
+	: buf_len(len)
 {
+	reset();
 	data = new uint32_t[len];
 }

@@ -39,6 +39,14 @@ smpl_buf::~smpl_buf()
 	delete[] data;
 }

+void smpl_buf::reset()
+{
+	time_start = 0;
+	time_end = 0;
+	data_start = 0;
+	data_end = 0;
+}
+
 ssize_t smpl_buf::avail_smpls(TIMESTAMP timestamp) const
 {
 	if (timestamp < time_start)
--- a/Transceiver52M/device/common/smpl_buf.h
+++ b/Transceiver52M/device/common/smpl_buf.h
@@ -44,6 +44,10 @@ public:
 	smpl_buf(size_t len);
 	~smpl_buf();

+	/** Reset this buffer, keeps the size
+	*/
+	void reset();
+
 	/** Query number of samples available for reading
 	    @param timestamp time of first sample
 	    @return number of available samples or error
--- a/Transceiver52M/device/ipc/IPCDevice.cpp
+++ b/Transceiver52M/device/ipc/IPCDevice.cpp
--- a/Transceiver52M/device/ipc/IPCDevice.h
+++ b/Transceiver52M/device/ipc/IPCDevice.h
@@ -0,0 +1,241 @@
+/*
+* Copyright 2020 sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+* Author: Pau Espin Pedrol <pespin@sysmocom.de>
+*
+* SPDX-License-Identifier: AGPL-3.0+
+*
+* This program is free software: you can redistribute it and/or modify
+* it under the terms of the GNU Affero General Public License as published by
+* the Free Software Foundation, either version 3 of the License, or
+* (at your option) any later version.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU Affero General Public License for more details.
+*
+* You should have received a copy of the GNU Affero General Public License
+* along with this program.  If not, see <http://www.gnu.org/licenses/>.
+* See the COPYING file in the main directory for details.
+*/
+
+#ifndef _IPC_DEVICE_H_
+#define _IPC_DEVICE_H_
+
+#include <cstdint>
+#include <cstddef>
+#include <climits>
+#include <string>
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+extern "C" {
+#include <osmocom/core/select.h>
+#include <osmocom/core/timer.h>
+#include "shm.h"
+}
+
+#include "radioDevice.h"
+
+class smpl_buf;
+
+#define IPC_MAX_NUM_TRX 8
+
+struct ipc_per_trx_sock_state {
+	struct osmo_fd conn_bfd; /* fd for connection to the BTS */
+	struct osmo_timer_list timer; /* socket connect retry timer */
+	struct llist_head upqueue; /* queue for sending messages */
+	uint32_t messages_processed_mask; // (=| IPC_IF_MSG_xxx-IPC_IF_CHAN_MSG_OFFSET) bitmask
+	ipc_per_trx_sock_state() : conn_bfd(), timer(), upqueue(), messages_processed_mask()
+	{
+		conn_bfd.fd = -1;
+	}
+};
+
+class IPCDevice : public RadioDevice {
+    protected:
+	struct ipc_per_trx_sock_state master_sk_state;
+
+	std::vector<struct ipc_per_trx_sock_state> sk_chan_state;
+
+	uint32_t tx_attenuation[IPC_MAX_NUM_TRX];
+	uint8_t tmp_state;
+	char shm_name[SHM_NAME_MAX];
+	int ipc_shm_connect(const char *shm_name);
+	void *shm;
+	struct ipc_shm_region *shm_dec;
+
+	std::vector<smpl_buf *> rx_buffers;
+	double actualSampleRate;
+
+	bool started;
+
+	TIMESTAMP ts_initial, ts_offset;
+
+	std::vector<double> tx_gains, rx_gains;
+
+	struct ipc_sk_if_info_req current_info_req;
+	struct ipc_sk_if_info_cnf current_info_cnf;
+	struct ipc_sk_if_open_cnf current_open_cnf;
+
+	std::vector<struct ipc_shm_io *> shm_io_rx_streams;
+	std::vector<struct ipc_shm_io *> shm_io_tx_streams;
+
+	bool flush_recv(size_t num_pkts);
+	void update_stream_stats_rx(size_t chan, bool *overrun);
+	void update_stream_stats_tx(size_t chan, bool *underrun);
+	void manually_poll_sock_fds();
+
+	void ipc_sock_close(ipc_per_trx_sock_state *state);
+
+	int ipc_rx(uint8_t msg_type, struct ipc_sk_if *ipc_prim);
+	int ipc_rx_greeting_cnf(const struct ipc_sk_if_greeting *greeting_cnf);
+	int ipc_rx_info_cnf(const struct ipc_sk_if_info_cnf *info_cnf);
+	int ipc_rx_open_cnf(const struct ipc_sk_if_open_cnf *open_cnf);
+	int ipc_tx_open_req(struct ipc_per_trx_sock_state *state, uint32_t num_chans, uint32_t ref);
+
+	int ipc_chan_rx(uint8_t msg_type, ipc_sk_chan_if *ipc_prim, uint8_t chan_nr);
+	int ipc_rx_chan_start_cnf(ipc_sk_chan_if_op_rc *ret, uint8_t chan_nr);
+	int ipc_rx_chan_stop_cnf(ipc_sk_chan_if_op_rc *ret, uint8_t chan_nr);
+	int ipc_rx_chan_setgain_cnf(ipc_sk_chan_if_gain *ret, uint8_t chan_nr);
+	int ipc_rx_chan_setfreq_cnf(ipc_sk_chan_if_freq_cnf *ret, uint8_t chan_nr);
+	int ipc_rx_chan_notify_underflow(ipc_sk_chan_if_notfiy *ret, uint8_t chan_nr);
+	int ipc_rx_chan_notify_overflow(ipc_sk_chan_if_notfiy *ret, uint8_t chan_nr);
+	int ipc_rx_chan_settxattn_cnf(ipc_sk_chan_if_tx_attenuation *ret, uint8_t chan_nr);
+
+	bool send_chan_wait_rsp(uint32_t chan, struct msgb *msg_to_send, uint32_t expected_rsp_msg_id);
+	bool send_all_chan_wait_rsp(uint32_t msgid_to_send, uint32_t msgid_to_expect);
+
+    public:
+	int ipc_sock_read(struct osmo_fd *bfd);
+	int ipc_sock_write(struct osmo_fd *bfd);
+	int ipc_chan_sock_read(osmo_fd *bfd);
+	int ipc_chan_sock_write(osmo_fd *bfd);
+
+	/** Object constructor */
+	IPCDevice(InterfaceType iface, const struct trx_cfg *cfg);
+	virtual ~IPCDevice() override;
+
+	/** Instantiate the IPC */
+	virtual int open() override;
+
+	/** Start the IPC */
+	virtual bool start() override;
+
+	/** Stop the IPC */
+	virtual bool stop() override;
+
+	/* FIXME: any != USRP1 will do for now... */
+	enum TxWindowType getWindowType() override
+	{
+		return TX_WINDOW_LMS1;
+	}
+
+	/**
+	Read samples from the IPC.
+	@param buf preallocated buf to contain read result
+	@param len number of samples desired
+	@param overrun Set if read buffer has been overrun, e.g. data not being read fast enough
+	@param timestamp The timestamp of the first samples to be read
+	@param underrun Set if IPC does not have data to transmit, e.g. data not being sent fast enough
+	@return The number of samples actually read
+	*/
+	virtual int readSamples(std::vector<short *> &buf, int len, bool *overrun, TIMESTAMP timestamp = 0xffffffff,
+				bool *underrun = NULL) override;
+	/**
+	Write samples to the IPC.
+	@param buf Contains the data to be written.
+	@param len number of samples to write.
+	@param underrun Set if IPC does not have data to transmit, e.g. data not being sent fast enough
+	@param timestamp The timestamp of the first sample of the data buffer.
+	@return The number of samples actually written
+	*/
+	virtual int writeSamples(std::vector<short *> &bufs, int len, bool *underrun,
+				 TIMESTAMP timestamp = 0xffffffff) override;
+
+	/** Update the alignment between the read and write timestamps */
+	virtual bool updateAlignment(TIMESTAMP timestamp) override;
+
+	/** Set the transmitter frequency */
+	virtual bool setTxFreq(double wFreq, size_t chan = 0) override;
+
+	/** Set the receiver frequency */
+	virtual bool setRxFreq(double wFreq, size_t chan = 0) override;
+
+	/** Returns the starting write Timestamp*/
+	virtual TIMESTAMP initialWriteTimestamp(void) override;
+
+	/** Returns the starting read Timestamp*/
+	virtual TIMESTAMP initialReadTimestamp(void) override;
+
+	/** returns the full-scale transmit amplitude **/
+	virtual double fullScaleInputValue() override
+	{
+		return (double)SHRT_MAX * current_info_cnf.iq_scaling_val_rx;
+	}
+
+	/** returns the full-scale receive amplitude **/
+	virtual double fullScaleOutputValue() override
+	{
+		return (double)SHRT_MAX * current_info_cnf.iq_scaling_val_tx;
+	}
+
+	/** sets the receive chan gain, returns the gain setting **/
+	virtual double setRxGain(double dB, size_t chan = 0) override;
+
+	/** get the current receive gain */
+	virtual double getRxGain(size_t chan = 0) override
+	{
+		return rx_gains[chan];
+	}
+
+	/** return maximum Rx Gain **/
+	virtual double maxRxGain(void) override;
+
+	/** return minimum Rx Gain **/
+	virtual double minRxGain(void) override;
+
+	/* FIXME: return rx_gains[chan] ? receive factor from IPC Driver? */
+	double rssiOffset(size_t chan) override { return 0.0f; };
+
+	double setPowerAttenuation(int atten, size_t chan) override;
+	double getPowerAttenuation(size_t chan = 0) override;
+
+	virtual int getNominalTxPower(size_t chan = 0) override;
+
+	/** sets the RX path to use, returns true if successful and false otherwise */
+	virtual bool setRxAntenna(const std::string &ant, size_t chan = 0) override;
+
+	/* return the used RX path */
+	virtual std::string getRxAntenna(size_t chan = 0) override;
+
+	/** sets the RX path to use, returns true if successful and false otherwise */
+	virtual bool setTxAntenna(const std::string &ant, size_t chan = 0) override;
+
+	/* return the used RX path */
+	virtual std::string getTxAntenna(size_t chan = 0) override;
+
+	/** return whether user drives synchronization of Tx/Rx of USRP */
+	virtual bool requiresRadioAlign() override;
+
+	/** return whether user drives synchronization of Tx/Rx of USRP */
+	virtual GSM::Time minLatency() override;
+
+	/** Return internal status values */
+	virtual inline double getTxFreq(size_t chan = 0) override
+	{
+		return 0;
+	}
+	virtual inline double getRxFreq(size_t chan = 0) override
+	{
+		return 0;
+	}
+	virtual inline double getSampleRate() override
+	{
+		return actualSampleRate;
+	}
+};
+
+#endif // _IPC_DEVICE_H_
--- a/Transceiver52M/device/ipc/Makefile.am
+++ b/Transceiver52M/device/ipc/Makefile.am
@@ -0,0 +1,34 @@
+include $(top_srcdir)/Makefile.common
+
+AM_CPPFLAGS = $(STD_DEFINES_AND_INCLUDES) -I${srcdir}/../common
+AM_CFLAGS = -Wall $(LIBOSMOCORE_CFLAGS) $(UHD_CFLAGS)
+AM_CXXFLAGS = -Wall $(LIBOSMOCORE_CFLAGS) $(UHD_CFLAGS)
+
+noinst_HEADERS = IPCDevice.h shm.h ipc_shm.h ipc_chan.h ipc_sock.h
+
+if DEVICE_UHD
+noinst_HEADERS += ../uhd/UHDDevice.h uhdwrap.h ipc-driver-test.h
+endif
+
+noinst_LTLIBRARIES = libdevice.la
+
+libdevice_la_SOURCES = IPCDevice.cpp shm.c ipc_shm.c ipc_chan.c ipc_sock.c
+libdevice_la_CPPFLAGS = $(AM_CPPFLAGS) -DIPCMAGIC
+libdevice_la_LIBADD = \
+	$(top_builddir)/Transceiver52M/device/common/libdevice_common.la \
+	-lpthread \
+	-lrt \
+	$(NULL)
+
+if DEVICE_UHD
+
+bin_PROGRAMS = ipc-driver-test
+#ipc_driver_test_SHORTNAME = drvt
+ipc_driver_test_SOURCES = ipc-driver-test.c uhdwrap.cpp ../uhd/UHDDevice.cpp
+ipc_driver_test_LDADD = \
+	libdevice.la \
+	$(COMMON_LA) \
+	$(LIBOSMOCORE_LIBS) \
+	$(UHD_LIBS) \
+	$(NULL)
+endif
--- a/Transceiver52M/device/ipc/ipc-driver-test.c
+++ b/Transceiver52M/device/ipc/ipc-driver-test.c
@@ -0,0 +1,492 @@
+/*
+* Copyright 2020 sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+* Author: Pau Espin Pedrol <pespin@sysmocom.de>
+*
+* SPDX-License-Identifier: 0BSD
+*
+* Permission to use, copy, modify, and/or distribute this software for any purpose
+* with or without fee is hereby granted.THE SOFTWARE IS PROVIDED "AS IS" AND THE
+* AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR
+* BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF
+* CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+* USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+
+#define _GNU_SOURCE
+#include <pthread.h>
+
+#include <debug.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+#include <assert.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <inttypes.h>
+#include <sys/mman.h>
+#include <sys/stat.h> /* For mode constants */
+#include <fcntl.h> /* For O_* constants */
+#include <getopt.h>
+
+#include <osmocom/core/application.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/timer.h>
+
+#include "shm.h"
+#include "ipc_shm.h"
+#include "ipc_chan.h"
+#include "ipc_sock.h"
+
+#define DEFAULT_SHM_NAME "/osmo-trx-ipc-driver-shm2"
+#define IPC_SOCK_PATH_PREFIX "/tmp"
+
+static void *tall_ctx;
+struct ipc_sock_state *global_ipc_sock_state;
+
+/* 8 channels are plenty */
+struct ipc_sock_state *global_ctrl_socks[8];
+struct ipc_shm_io *ios_tx_to_device[8];
+struct ipc_shm_io *ios_rx_from_device[8];
+
+void *shm;
+void *global_dev;
+
+static struct ipc_shm_region *decoded_region;
+
+static struct {
+	int msocknum;
+	char *ud_prefix_dir;
+} cmdline_cfg;
+
+static const struct log_info_cat default_categories[] = {
+	[DMAIN] = {
+		.name = "DMAIN",
+		.color = NULL,
+		.description = "Main generic category",
+		.loglevel = LOGL_DEBUG,.enabled = 1,
+	},
+	[DDEV] = {
+		.name = "DDEV",
+		.description = "Device/Driver specific code",
+		.color = NULL,
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
+};
+
+const struct log_info log_infox = {
+	.cat = default_categories,
+	.num_cat = ARRAY_SIZE(default_categories),
+};
+
+#include "uhdwrap.h"
+
+volatile int ipc_exit_requested = 0;
+
+static int ipc_shm_setup(const char *shm_name, size_t shm_len)
+{
+	int fd;
+	int rc;
+
+	LOGP(DMAIN, LOGL_NOTICE, "Opening shm path %s\n", shm_name);
+	if ((fd = shm_open(shm_name, O_CREAT | O_RDWR | O_TRUNC, S_IRUSR | S_IWUSR)) < 0) {
+		LOGP(DMAIN, LOGL_ERROR, "shm_open %d: %s\n", errno, strerror(errno));
+		rc = -errno;
+		goto err_shm_open;
+	}
+
+	LOGP(DMAIN, LOGL_NOTICE, "Truncating %d to size %zu\n", fd, shm_len);
+	if (ftruncate(fd, shm_len) < 0) {
+		LOGP(DMAIN, LOGL_ERROR, "ftruncate %d: %s\n", errno, strerror(errno));
+		rc = -errno;
+		goto err_mmap;
+	}
+
+	LOGP(DMAIN, LOGL_NOTICE, "mmaping shared memory fd %d\n", fd);
+	if ((shm = mmap(NULL, shm_len, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0)) == MAP_FAILED) {
+		LOGP(DMAIN, LOGL_ERROR, "mmap %d: %s\n", errno, strerror(errno));
+		rc = -errno;
+		goto err_mmap;
+	}
+
+	LOGP(DMAIN, LOGL_NOTICE, "mmap'ed shared memory at addr %p\n", shm);
+	/* After a call to mmap(2) the file descriptor may be closed without affecting the memory mapping. */
+	close(fd);
+	return 0;
+err_mmap:
+	shm_unlink(shm_name);
+	close(fd);
+err_shm_open:
+	return rc;
+}
+
+struct msgb *ipc_msgb_alloc(uint8_t msg_type)
+{
+	struct msgb *msg;
+	struct ipc_sk_if *ipc_prim;
+
+	msg = msgb_alloc(sizeof(struct ipc_sk_if) + 1000, "ipc_sock_tx");
+	if (!msg)
+		return NULL;
+	msgb_put(msg, sizeof(struct ipc_sk_if) + 1000);
+	ipc_prim = (struct ipc_sk_if *)msg->data;
+	ipc_prim->msg_type = msg_type;
+
+	return msg;
+}
+
+static int ipc_tx_greeting_cnf(uint8_t req_version)
+{
+	struct msgb *msg;
+	struct ipc_sk_if *ipc_prim;
+
+	msg = ipc_msgb_alloc(IPC_IF_MSG_GREETING_CNF);
+	if (!msg)
+		return -ENOMEM;
+	ipc_prim = (struct ipc_sk_if *)msg->data;
+	ipc_prim->u.greeting_cnf.req_version = req_version;
+
+	return ipc_sock_send(msg);
+}
+
+static int ipc_tx_info_cnf()
+{
+	struct msgb *msg;
+	struct ipc_sk_if *ipc_prim;
+
+	msg = ipc_msgb_alloc(IPC_IF_MSG_INFO_CNF);
+	if (!msg)
+		return -ENOMEM;
+	ipc_prim = (struct ipc_sk_if *)msg->data;
+
+	uhdwrap_fill_info_cnf(ipc_prim);
+
+	return ipc_sock_send(msg);
+}
+
+static int ipc_tx_open_cnf(int rc, uint32_t num_chans, int32_t timingoffset)
+{
+	struct msgb *msg;
+	struct ipc_sk_if *ipc_prim;
+	struct ipc_sk_if_open_cnf_chan *chan_info;
+	unsigned int i;
+
+	msg = ipc_msgb_alloc(IPC_IF_MSG_OPEN_CNF);
+	if (!msg)
+		return -ENOMEM;
+	ipc_prim = (struct ipc_sk_if *)msg->data;
+	ipc_prim->u.open_cnf.return_code = rc;
+	ipc_prim->u.open_cnf.path_delay = timingoffset; // 6.18462e-5 * 1625e3 / 6;
+	OSMO_STRLCPY_ARRAY(ipc_prim->u.open_cnf.shm_name, DEFAULT_SHM_NAME);
+
+	chan_info = ipc_prim->u.open_cnf.chan_info;
+	for (i = 0; i < num_chans; i++) {
+		snprintf(chan_info->chan_ipc_sk_path, sizeof(chan_info->chan_ipc_sk_path),"%s/ipc_sock%d_%d",
+			 cmdline_cfg.ud_prefix_dir, cmdline_cfg.msocknum, i);
+		/* FIXME: dynamc chan limit, currently 8 */
+		if (i < 8)
+			ipc_sock_init(chan_info->chan_ipc_sk_path, &global_ctrl_socks[i], ipc_chan_sock_accept, i);
+		chan_info++;
+	}
+
+	return ipc_sock_send(msg);
+}
+
+int ipc_rx_greeting_req(struct ipc_sk_if_greeting *greeting_req)
+{
+	if (greeting_req->req_version == IPC_SOCK_API_VERSION)
+		ipc_tx_greeting_cnf(IPC_SOCK_API_VERSION);
+	else
+		ipc_tx_greeting_cnf(0);
+	return 0;
+}
+
+int ipc_rx_info_req(struct ipc_sk_if_info_req *info_req)
+{
+	ipc_tx_info_cnf();
+	return 0;
+}
+
+int ipc_rx_open_req(struct ipc_sk_if_open_req *open_req)
+{
+	/* calculate size needed */
+	unsigned int len;
+	unsigned int i;
+
+	global_dev = uhdwrap_open(open_req);
+
+	/* b210 packet size is 2040, but our tx size is 2500, so just do *2 */
+	int shmbuflen = uhdwrap_get_bufsizerx(global_dev) * 2;
+
+	len = ipc_shm_encode_region(NULL, open_req->num_chans, 4, shmbuflen);
+	/* Here we verify num_chans, rx_path, tx_path, clockref, etc. */
+	int rc = ipc_shm_setup(DEFAULT_SHM_NAME, len);
+	len = ipc_shm_encode_region((struct ipc_shm_raw_region *)shm, open_req->num_chans, 4, shmbuflen);
+	//	LOGP(DMAIN, LOGL_NOTICE, "%s\n", osmo_hexdump((const unsigned char *)shm, 80));
+
+	/* set up our own copy of the decoded area, we have to do it here,
+	* since the uhd wrapper does not allow starting single channels
+	* additionally go for the producer init for both, so only we are responsible for the init, instead
+	* of splitting it with the client and causing potential races if one side uses it too early */
+	decoded_region = ipc_shm_decode_region(0, (struct ipc_shm_raw_region *)shm);
+	for (i = 0; i < open_req->num_chans; i++) {
+		//		ios_tx_to_device[i] = ipc_shm_init_consumer(decoded_region->channels[i]->dl_stream);
+		ios_tx_to_device[i] = ipc_shm_init_producer(decoded_region->channels[i]->dl_stream);
+		ios_rx_from_device[i] = ipc_shm_init_producer(decoded_region->channels[i]->ul_stream);
+	}
+
+	ipc_tx_open_cnf(-rc, open_req->num_chans, uhdwrap_get_timingoffset(global_dev));
+	return 0;
+}
+
+volatile bool ul_running = false;
+volatile bool dl_running = false;
+
+void *uplink_thread(void *x_void_ptr)
+{
+	uint32_t chann = decoded_region->num_chans;
+	ul_running = true;
+	pthread_setname_np(pthread_self(), "uplink_rx");
+
+	while (!ipc_exit_requested) {
+		int32_t read = uhdwrap_read(global_dev, chann);
+		if (read < 0)
+			return 0;
+	}
+	return 0;
+}
+
+void *downlink_thread(void *x_void_ptr)
+{
+	int chann = decoded_region->num_chans;
+	dl_running = true;
+	pthread_setname_np(pthread_self(), "downlink_tx");
+
+	while (!ipc_exit_requested) {
+		bool underrun;
+		uhdwrap_write(global_dev, chann, &underrun);
+	}
+	return 0;
+}
+
+int ipc_rx_chan_start_req(struct ipc_sk_chan_if_op_void *req, uint8_t chan_nr)
+{
+	struct msgb *msg;
+	struct ipc_sk_chan_if *ipc_prim;
+	int rc = 0;
+
+	rc = uhdwrap_start(global_dev, chan_nr);
+
+	/* no per-chan start/stop */
+	if (!dl_running || !ul_running) {
+		/* chan != first chan start will "fail", which is fine, usrp can't start/stop chans independently */
+		if (rc) {
+			LOGP(DMAIN, LOGL_INFO, "starting rx/tx threads.. req for chan:%d\n", chan_nr);
+			pthread_t rx, tx;
+			pthread_create(&rx, NULL, uplink_thread, 0);
+			pthread_create(&tx, NULL, downlink_thread, 0);
+		}
+	} else
+		LOGP(DMAIN, LOGL_INFO, "starting rx/tx threads request ignored.. req for chan:%d\n", chan_nr);
+
+	msg = ipc_msgb_alloc(IPC_IF_MSG_START_CNF);
+	if (!msg)
+		return -ENOMEM;
+	ipc_prim = (struct ipc_sk_chan_if *)msg->data;
+	ipc_prim->u.start_cnf.return_code = rc ? 0 : -1;
+
+	return ipc_chan_sock_send(msg, chan_nr);
+}
+int ipc_rx_chan_stop_req(struct ipc_sk_chan_if_op_void *req, uint8_t chan_nr)
+{
+	struct msgb *msg;
+	struct ipc_sk_chan_if *ipc_prim;
+	int rc;
+
+	/* no per-chan start/stop */
+	rc = uhdwrap_stop(global_dev, chan_nr);
+
+	msg = ipc_msgb_alloc(IPC_IF_MSG_STOP_CNF);
+	if (!msg)
+		return -ENOMEM;
+	ipc_prim = (struct ipc_sk_chan_if *)msg->data;
+	ipc_prim->u.stop_cnf.return_code = rc ? 0 : -1;
+
+	return ipc_chan_sock_send(msg, chan_nr);
+}
+int ipc_rx_chan_setgain_req(struct ipc_sk_chan_if_gain *req, uint8_t chan_nr)
+{
+	struct msgb *msg;
+	struct ipc_sk_chan_if *ipc_prim;
+	double rv;
+
+	rv = uhdwrap_set_gain(global_dev, req->gain, chan_nr, req->is_tx);
+
+	msg = ipc_msgb_alloc(IPC_IF_MSG_SETGAIN_CNF);
+	if (!msg)
+		return -ENOMEM;
+	ipc_prim = (struct ipc_sk_chan_if *)msg->data;
+	ipc_prim->u.set_gain_cnf.is_tx = req->is_tx;
+	ipc_prim->u.set_gain_cnf.gain = rv;
+
+	return ipc_chan_sock_send(msg, chan_nr);
+}
+
+int ipc_rx_chan_setfreq_req(struct ipc_sk_chan_if_freq_req *req, uint8_t chan_nr)
+{
+	struct msgb *msg;
+	struct ipc_sk_chan_if *ipc_prim;
+	bool rv;
+
+	rv = uhdwrap_set_freq(global_dev, req->freq, chan_nr, req->is_tx);
+
+	msg = ipc_msgb_alloc(IPC_IF_MSG_SETFREQ_CNF);
+	if (!msg)
+		return -ENOMEM;
+	ipc_prim = (struct ipc_sk_chan_if *)msg->data;
+	ipc_prim->u.set_freq_cnf.return_code = rv ? 0 : 1;
+
+	return ipc_chan_sock_send(msg, chan_nr);
+}
+
+int ipc_rx_chan_settxatten_req(struct ipc_sk_chan_if_tx_attenuation *req, uint8_t chan_nr)
+{
+	struct msgb *msg;
+	struct ipc_sk_chan_if *ipc_prim;
+	double rv;
+
+	rv = uhdwrap_set_txatt(global_dev, req->attenuation, chan_nr);
+
+	msg = ipc_msgb_alloc(IPC_IF_MSG_SETTXATTN_CNF);
+	if (!msg)
+		return -ENOMEM;
+	ipc_prim = (struct ipc_sk_chan_if *)msg->data;
+	ipc_prim->u.txatten_cnf.attenuation = rv;
+
+	return ipc_chan_sock_send(msg, chan_nr);
+}
+
+int ipc_sock_init(const char *path, struct ipc_sock_state **global_state_var,
+		  int (*sock_callback_fn)(struct osmo_fd *fd, unsigned int what), int n)
+{
+	struct ipc_sock_state *state;
+	struct osmo_fd *bfd;
+	int rc;
+
+	state = talloc_zero(NULL, struct ipc_sock_state);
+	if (!state)
+		return -ENOMEM;
+	*global_state_var = state;
+
+	INIT_LLIST_HEAD(&state->upqueue);
+	state->conn_bfd.fd = -1;
+
+	bfd = &state->listen_bfd;
+
+	bfd->fd = osmo_sock_unix_init(SOCK_SEQPACKET, 0, path, OSMO_SOCK_F_BIND);
+	if (bfd->fd < 0) {
+		LOGP(DMAIN, LOGL_ERROR, "Could not create %s unix socket: %s\n", path, strerror(errno));
+		talloc_free(state);
+		return -1;
+	}
+
+	osmo_fd_setup(bfd, bfd->fd, OSMO_FD_READ, sock_callback_fn, state, n);
+
+	rc = osmo_fd_register(bfd);
+	if (rc < 0) {
+		LOGP(DMAIN, LOGL_ERROR, "Could not register listen fd: %d\n", rc);
+		close(bfd->fd);
+		talloc_free(state);
+		return rc;
+	}
+
+	LOGP(DMAIN, LOGL_INFO, "Started listening on IPC socket: %s\n", path);
+
+	return 0;
+}
+
+static void print_help(void)
+{
+	printf("ipc-driver-test Usage:\n"
+	       " -h  --help		This message\n"
+	       " -u  --unix-sk-dir DIR	Existing directory where to create the Master socket\n"
+	       " -n  --sock-num NR	Master socket suffix number NR\n");
+}
+
+static void handle_options(int argc, char **argv)
+{
+	while (1) {
+		int option_index = 0, c;
+		const struct option long_options[] = { { "help", 0, 0, 'h' },
+						       { "unix-sk-dir", 1, 0, 'u' },
+						       { "sock-num", 1, 0, 'n' },
+						       { 0, 0, 0, 0 } };
+
+		c = getopt_long(argc, argv, "hu:n:", long_options, &option_index);
+		if (c == -1)
+			break;
+
+		switch (c) {
+		case 'h':
+			print_help();
+			exit(0);
+			break;
+		case 'u':
+			cmdline_cfg.ud_prefix_dir = talloc_strdup(tall_ctx, optarg);
+			break;
+		case 'n':
+			cmdline_cfg.msocknum = atoi(optarg);
+			break;
+
+		default:
+			exit(2);
+			break;
+		}
+	}
+
+	if (argc > optind) {
+		fprintf(stderr, "Unsupported positional arguments on command line\n");
+		exit(2);
+	}
+}
+
+int main(int argc, char **argv)
+{
+	char ipc_msock_path[128];
+	tall_ctx = talloc_named_const(NULL, 0, "OsmoTRX");
+	msgb_talloc_ctx_init(tall_ctx, 0);
+	osmo_init_logging2(tall_ctx, &log_infox);
+	log_enable_multithread();
+
+	handle_options(argc, argv);
+
+	if (!cmdline_cfg.ud_prefix_dir)
+		cmdline_cfg.ud_prefix_dir = talloc_strdup(tall_ctx, IPC_SOCK_PATH_PREFIX);
+
+
+	snprintf(ipc_msock_path, sizeof(ipc_msock_path), "%s/ipc_sock%d", cmdline_cfg.ud_prefix_dir, cmdline_cfg.msocknum);
+
+	LOGP(DMAIN, LOGL_INFO, "Starting %s\n", argv[0]);
+	ipc_sock_init(ipc_msock_path, &global_ipc_sock_state, ipc_sock_accept, 0);
+	while (!ipc_exit_requested)
+		osmo_select_main(0);
+
+	if (global_dev) {
+		unsigned int i;
+		for (i = 0; i < decoded_region->num_chans; i++)
+			uhdwrap_stop(global_dev, i);
+	}
+
+	ipc_sock_close(global_ipc_sock_state);
+	return 0;
+}
--- a/Transceiver52M/device/ipc/ipc-driver-test.h
+++ b/Transceiver52M/device/ipc/ipc-driver-test.h
@@ -0,0 +1,45 @@
+/*
+* Copyright 2020 sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+* Author: Pau Espin Pedrol <pespin@sysmocom.de>
+*
+* SPDX-License-Identifier: 0BSD
+*
+* Permission to use, copy, modify, and/or distribute this software for any purpose
+* with or without fee is hereby granted.THE SOFTWARE IS PROVIDED "AS IS" AND THE
+* AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR
+* BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF
+* CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+* USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+#pragma once
+
+#include <osmocom/core/select.h>
+#include "shm.h"
+
+extern struct ipc_sock_state *global_ipc_sock_state;
+
+/* 8 channels are plenty */
+extern struct ipc_sock_state *global_ctrl_socks[8];
+extern struct ipc_shm_io *ios_tx_to_device[8];
+extern struct ipc_shm_io *ios_rx_from_device[8];
+
+struct ipc_sock_state {
+	struct osmo_fd listen_bfd; /* fd for listen socket */
+	struct osmo_fd conn_bfd; /* fd for connection */
+	struct llist_head upqueue; /* queue for sending messages */
+};
+
+int ipc_sock_init(const char *path, struct ipc_sock_state **global_state_var,
+		  int (*sock_callback_fn)(struct osmo_fd *fd, unsigned int what), int n);
+
+int ipc_rx_greeting_req(struct ipc_sk_if_greeting *greeting_req);
+int ipc_rx_info_req(struct ipc_sk_if_info_req *info_req);
+int ipc_rx_open_req(struct ipc_sk_if_open_req *open_req);
+
+int ipc_rx_chan_start_req(struct ipc_sk_chan_if_op_void *req, uint8_t chan_nr);
+int ipc_rx_chan_stop_req(struct ipc_sk_chan_if_op_void *req, uint8_t chan_nr);
+int ipc_rx_chan_setgain_req(struct ipc_sk_chan_if_gain *req, uint8_t chan_nr);
+int ipc_rx_chan_setfreq_req(struct ipc_sk_chan_if_freq_req *req, uint8_t chan_nr);
+int ipc_rx_chan_settxatten_req(struct ipc_sk_chan_if_tx_attenuation *req, uint8_t chan_nr);
--- a/Transceiver52M/device/ipc/ipc_chan.c
+++ b/Transceiver52M/device/ipc/ipc_chan.c
@@ -0,0 +1,254 @@
+/*
+* Copyright 2020 sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+* Author: Pau Espin Pedrol <pespin@sysmocom.de>
+*
+* SPDX-License-Identifier: 0BSD
+*
+* Permission to use, copy, modify, and/or distribute this software for any purpose
+* with or without fee is hereby granted.THE SOFTWARE IS PROVIDED "AS IS" AND THE
+* AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR
+* BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF
+* CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+* USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+#include <assert.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <inttypes.h>
+#include <sys/mman.h>
+#include <sys/stat.h> /* For mode constants */
+#include <fcntl.h> /* For O_* constants */
+
+#include <debug.h>
+#include <osmocom/core/application.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/timer.h>
+
+#include "shm.h"
+#include "ipc-driver-test.h"
+#include "ipc_chan.h"
+#include "ipc_sock.h"
+
+static int ipc_chan_rx(uint8_t msg_type, struct ipc_sk_chan_if *ipc_prim, uint8_t chan_nr)
+{
+	int rc = 0;
+
+	switch (msg_type) {
+	case IPC_IF_MSG_START_REQ:
+		rc = ipc_rx_chan_start_req(&ipc_prim->u.start_req, chan_nr);
+		break;
+	case IPC_IF_MSG_STOP_REQ:
+		rc = ipc_rx_chan_stop_req(&ipc_prim->u.stop_req, chan_nr);
+		break;
+	case IPC_IF_MSG_SETGAIN_REQ:
+		rc = ipc_rx_chan_setgain_req(&ipc_prim->u.set_gain_req, chan_nr);
+		break;
+	case IPC_IF_MSG_SETFREQ_REQ:
+		rc = ipc_rx_chan_setfreq_req(&ipc_prim->u.set_freq_req, chan_nr);
+		break;
+	case IPC_IF_MSG_SETTXATTN_REQ:
+		rc = ipc_rx_chan_settxatten_req(&ipc_prim->u.txatten_req, chan_nr);
+		break;
+	default:
+		LOGP(DDEV, LOGL_ERROR, "Received unknown IPC msg type 0x%02x on chan %d\n", msg_type, chan_nr);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+static int ipc_chan_sock_read(struct osmo_fd *bfd)
+{
+	struct ipc_sock_state *state = (struct ipc_sock_state *)bfd->data;
+	struct ipc_sk_chan_if *ipc_prim;
+	struct msgb *msg;
+	int rc;
+
+	msg = msgb_alloc(sizeof(*ipc_prim) + 1000, "ipc_chan_sock_rx");
+	if (!msg)
+		return -ENOMEM;
+
+	ipc_prim = (struct ipc_sk_chan_if *)msg->tail;
+
+	rc = recv(bfd->fd, msg->tail, msgb_tailroom(msg), 0);
+	if (rc == 0)
+		goto close;
+
+	if (rc < 0) {
+		if (errno == EAGAIN) {
+			msgb_free(msg);
+			return 0;
+		}
+		goto close;
+	}
+
+	if (rc < (int)sizeof(*ipc_prim)) {
+		LOGP(DDEV, LOGL_ERROR,
+		     "Received %d bytes on Unix Socket, but primitive size "
+		     "is %zu, discarding\n",
+		     rc, sizeof(*ipc_prim));
+		msgb_free(msg);
+		return 0;
+	}
+
+	rc = ipc_chan_rx(ipc_prim->msg_type, ipc_prim, bfd->priv_nr);
+
+	/* as we always synchronously process the message in IPC_rx() and
+	 * its callbacks, we can free the message here. */
+	msgb_free(msg);
+
+	return rc;
+
+close:
+	msgb_free(msg);
+	ipc_sock_close(state);
+	return -1;
+}
+
+int ipc_chan_sock_send(struct msgb *msg, uint8_t chan_nr)
+{
+	struct ipc_sock_state *state = global_ctrl_socks[chan_nr];
+	struct osmo_fd *conn_bfd;
+
+	if (!state)
+		return -EINVAL;
+
+	if (!state) {
+		LOGP(DDEV, LOGL_INFO,
+		     "IPC socket not created, "
+		     "dropping message\n");
+		msgb_free(msg);
+		return -EINVAL;
+	}
+	conn_bfd = &state->conn_bfd;
+	if (conn_bfd->fd <= 0) {
+		LOGP(DDEV, LOGL_NOTICE,
+		     "IPC socket not connected, "
+		     "dropping message\n");
+		msgb_free(msg);
+		return -EIO;
+	}
+	msgb_enqueue(&state->upqueue, msg);
+	osmo_fd_write_enable(conn_bfd);
+
+	return 0;
+}
+
+static int ipc_chan_sock_write(struct osmo_fd *bfd)
+{
+	struct ipc_sock_state *state = (struct ipc_sock_state *)bfd->data;
+	int rc;
+
+	while (!llist_empty(&state->upqueue)) {
+		struct msgb *msg, *msg2;
+		struct ipc_sk_chan_if *ipc_prim;
+
+		/* peek at the beginning of the queue */
+		msg = llist_entry(state->upqueue.next, struct msgb, list);
+		ipc_prim = (struct ipc_sk_chan_if *)msg->data;
+
+		osmo_fd_write_disable(bfd);
+
+		/* bug hunter 8-): maybe someone forgot msgb_put(...) ? */
+		if (!msgb_length(msg)) {
+			LOGP(DDEV, LOGL_ERROR,
+			     "message type (%d) with ZERO "
+			     "bytes!\n",
+			     ipc_prim->msg_type);
+			goto dontsend;
+		}
+
+		/* try to send it over the socket */
+		rc = write(bfd->fd, msgb_data(msg), msgb_length(msg));
+		if (rc == 0)
+			goto close;
+		if (rc < 0) {
+			if (errno == EAGAIN) {
+				osmo_fd_write_enable(bfd);
+				break;
+			}
+			goto close;
+		}
+
+	dontsend:
+		/* _after_ we send it, we can dequeue */
+		msg2 = msgb_dequeue(&state->upqueue);
+		assert(msg == msg2);
+		msgb_free(msg);
+	}
+	return 0;
+
+close:
+	ipc_sock_close(state);
+	return -1;
+}
+
+static int ipc_chan_sock_cb(struct osmo_fd *bfd, unsigned int flags)
+{
+	int rc = 0;
+
+	if (flags & OSMO_FD_READ)
+		rc = ipc_chan_sock_read(bfd);
+	if (rc < 0)
+		return rc;
+
+	if (flags & OSMO_FD_WRITE)
+		rc = ipc_chan_sock_write(bfd);
+
+	return rc;
+}
+
+int ipc_chan_sock_accept(struct osmo_fd *bfd, unsigned int flags)
+{
+	struct ipc_sock_state *state = (struct ipc_sock_state *)bfd->data;
+	struct osmo_fd *conn_bfd = &state->conn_bfd;
+	struct sockaddr_un un_addr;
+	socklen_t len;
+	int rc;
+
+	len = sizeof(un_addr);
+	rc = accept(bfd->fd, (struct sockaddr *)&un_addr, &len);
+	if (rc < 0) {
+		LOGP(DDEV, LOGL_ERROR, "Failed to accept a new connection\n");
+		return -1;
+	}
+
+	if (conn_bfd->fd >= 0) {
+		LOGP(DDEV, LOGL_NOTICE,
+		     "osmo-trx connects but we already have "
+		     "another active connection ?!?\n");
+		/* We already have one IPC connected, this is all we support */
+		osmo_fd_read_disable(&state->listen_bfd);
+		close(rc);
+		return 0;
+	}
+
+	/* copy chan nr, required for proper bfd<->chan # mapping */
+	osmo_fd_setup(conn_bfd, rc, OSMO_FD_READ, ipc_chan_sock_cb, state, bfd->priv_nr);
+
+	if (osmo_fd_register(conn_bfd) != 0) {
+		LOGP(DDEV, LOGL_ERROR,
+		     "Failed to register new connection "
+		     "fd\n");
+		close(conn_bfd->fd);
+		conn_bfd->fd = -1;
+		return -1;
+	}
+
+	LOGP(DDEV, LOGL_NOTICE, "Unix socket connected to external osmo-trx\n");
+
+	return 0;
+}
--- a/Transceiver52M/device/ipc/ipc_chan.h
+++ b/Transceiver52M/device/ipc/ipc_chan.h
@@ -0,0 +1,25 @@
+/*
+* Copyright 2020 sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+* Author: Pau Espin Pedrol <pespin@sysmocom.de>
+*
+* SPDX-License-Identifier: 0BSD
+*
+* Permission to use, copy, modify, and/or distribute this software for any purpose
+* with or without fee is hereby granted.THE SOFTWARE IS PROVIDED "AS IS" AND THE
+* AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR
+* BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF
+* CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+* USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+#ifndef IPC_CHAN_H
+#define IPC_CHAN_H
+
+#include "shm.h"
+#include "ipc-driver-test.h"
+
+int ipc_chan_sock_send(struct msgb *msg, uint8_t chan_nr);
+int ipc_chan_sock_accept(struct osmo_fd *bfd, unsigned int flags);
+
+#endif // IPC_CHAN_H
--- a/Transceiver52M/device/ipc/ipc_shm.c
+++ b/Transceiver52M/device/ipc/ipc_shm.c
@@ -0,0 +1,200 @@
+/*
+* Copyright 2020 sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+* Author: Eric Wild <ewild@sysmocom.de>
+*
+* SPDX-License-Identifier: 0BSD
+*
+* Permission to use, copy, modify, and/or distribute this software for any purpose
+* with or without fee is hereby granted.THE SOFTWARE IS PROVIDED "AS IS" AND THE
+* AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR
+* BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF
+* CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+* USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <shm.h>
+#include "ipc_shm.h"
+#include <pthread.h>
+#include <semaphore.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+#include <errno.h>
+#include <osmocom/core/panic.h>
+
+#include <debug.h>
+
+#ifdef __cplusplus
+}
+#endif
+
+#define SAMPLE_SIZE_BYTE (sizeof(uint16_t) * 2)
+
+struct ipc_shm_io *ipc_shm_init_consumer(struct ipc_shm_stream *s)
+{
+	unsigned int i;
+
+	struct ipc_shm_io *r = (struct ipc_shm_io *)malloc(sizeof(struct ipc_shm_io));
+	r->this_stream = s->raw;
+	r->buf_ptrs =
+		(volatile struct ipc_shm_raw_smpl_buf **)malloc(sizeof(struct ipc_shm_raw_smpl_buf *) * s->num_buffers);
+
+	/* save actual ptrs */
+	for (i = 0; i < s->num_buffers; i++)
+		r->buf_ptrs[i] = s->buffers[i];
+
+	r->partial_read_begin_ptr = 0;
+	return r;
+}
+
+struct ipc_shm_io *ipc_shm_init_producer(struct ipc_shm_stream *s)
+{
+	int rv;
+	pthread_mutexattr_t att;
+	pthread_condattr_t t1, t2;
+	struct ipc_shm_io *r = ipc_shm_init_consumer(s);
+	rv = pthread_mutexattr_init(&att);
+	if (rv != 0) {
+		osmo_panic("%s:%d rv:%d", __FILE__, __LINE__, rv);
+	}
+
+	rv = pthread_mutexattr_setrobust(&att, PTHREAD_MUTEX_ROBUST);
+	if (rv != 0) {
+		osmo_panic("%s:%d rv:%d", __FILE__, __LINE__, rv);
+	}
+
+	rv = pthread_mutexattr_setpshared(&att, PTHREAD_PROCESS_SHARED);
+	if (rv != 0) {
+		osmo_panic("%s:%d rv:%d", __FILE__, __LINE__, rv);
+	}
+
+	rv = pthread_mutex_init((pthread_mutex_t *)&r->this_stream->lock, &att);
+	if (rv != 0) {
+		osmo_panic("%s:%d rv:%d", __FILE__, __LINE__, rv);
+	}
+
+	pthread_mutexattr_destroy(&att);
+
+	rv = pthread_condattr_setpshared(&t1, PTHREAD_PROCESS_SHARED);
+	if (rv != 0) {
+		osmo_panic("%s:%d rv:%d", __FILE__, __LINE__, rv);
+	}
+
+	rv = pthread_condattr_setpshared(&t2, PTHREAD_PROCESS_SHARED);
+	if (rv != 0) {
+		osmo_panic("%s:%d rv:%d", __FILE__, __LINE__, rv);
+	}
+
+	rv = pthread_cond_init((pthread_cond_t *)&r->this_stream->cf, &t1);
+	if (rv != 0) {
+		osmo_panic("%s:%d rv:%d", __FILE__, __LINE__, rv);
+	}
+
+	rv = pthread_cond_init((pthread_cond_t *)&r->this_stream->ce, &t2);
+	if (rv != 0) {
+		osmo_panic("%s:%d rv:%d", __FILE__, __LINE__, rv);
+	}
+
+	pthread_condattr_destroy(&t1);
+	pthread_condattr_destroy(&t2);
+
+	r->this_stream->read_next = 0;
+	r->this_stream->write_next = 0;
+	return r;
+}
+
+void ipc_shm_close(struct ipc_shm_io *r)
+{
+	if (r) {
+		free(r->buf_ptrs);
+		free(r);
+	}
+}
+
+int32_t ipc_shm_enqueue(struct ipc_shm_io *r, uint64_t timestamp, uint32_t len_in_sps, uint16_t *data)
+{
+	volatile struct ipc_shm_raw_smpl_buf *buf;
+	int32_t rv;
+	struct timespec tv;
+	clock_gettime(CLOCK_REALTIME, &tv);
+	tv.tv_sec += 1;
+
+	rv = pthread_mutex_timedlock((pthread_mutex_t *)&r->this_stream->lock, &tv);
+	if (rv != 0)
+		return -rv;
+
+	while (((r->this_stream->write_next + 1) & (r->this_stream->num_buffers - 1)) == r->this_stream->read_next &&
+	       rv == 0)
+		rv = pthread_cond_timedwait((pthread_cond_t *)&r->this_stream->ce,
+					    (pthread_mutex_t *)&r->this_stream->lock, &tv);
+	if (rv != 0)
+		return -rv;
+
+	buf = r->buf_ptrs[r->this_stream->write_next];
+	buf->timestamp = timestamp;
+
+	rv = len_in_sps <= r->this_stream->buffer_size ? len_in_sps : r->this_stream->buffer_size;
+
+	memcpy((void *)buf->samples, data, SAMPLE_SIZE_BYTE * rv);
+	buf->data_len = rv;
+
+	r->this_stream->write_next = (r->this_stream->write_next + 1) & (r->this_stream->num_buffers - 1);
+
+	pthread_cond_signal((pthread_cond_t *)&r->this_stream->cf);
+	pthread_mutex_unlock((pthread_mutex_t *)&r->this_stream->lock);
+
+	return rv;
+}
+
+int32_t ipc_shm_read(struct ipc_shm_io *r, uint16_t *out_buf, uint32_t num_samples, uint64_t *timestamp,
+		     uint32_t timeout_seconds)
+{
+	volatile struct ipc_shm_raw_smpl_buf *buf;
+	int32_t rv;
+	uint8_t freeflag = 0;
+	struct timespec tv;
+	clock_gettime(CLOCK_REALTIME, &tv);
+	tv.tv_sec += timeout_seconds;
+
+	rv = pthread_mutex_timedlock((pthread_mutex_t *)&r->this_stream->lock, &tv);
+	if (rv != 0)
+		return -rv;
+
+	while (r->this_stream->write_next == r->this_stream->read_next && rv == 0)
+		rv = pthread_cond_timedwait((pthread_cond_t *)&r->this_stream->cf,
+					    (pthread_mutex_t *)&r->this_stream->lock, &tv);
+	if (rv != 0)
+		return -rv;
+
+	buf = r->buf_ptrs[r->this_stream->read_next];
+	if (buf->data_len <= num_samples) {
+		memcpy(out_buf, (void *)&buf->samples[r->partial_read_begin_ptr * 2], SAMPLE_SIZE_BYTE * buf->data_len);
+		r->partial_read_begin_ptr = 0;
+		rv = buf->data_len;
+		buf->data_len = 0;
+		r->this_stream->read_next = (r->this_stream->read_next + 1) & (r->this_stream->num_buffers - 1);
+		freeflag = 1;
+
+	} else /*if (buf->data_len > num_samples)*/ {
+		memcpy(out_buf, (void *)&buf->samples[r->partial_read_begin_ptr * 2], SAMPLE_SIZE_BYTE * num_samples);
+		r->partial_read_begin_ptr += num_samples;
+		buf->data_len -= num_samples;
+		rv = num_samples;
+	}
+
+	*timestamp = buf->timestamp;
+	buf->timestamp += rv;
+
+	if (freeflag)
+		pthread_cond_signal((pthread_cond_t *)&r->this_stream->ce);
+
+	pthread_mutex_unlock((pthread_mutex_t *)&r->this_stream->lock);
+
+	return rv;
+}
--- a/Transceiver52M/device/ipc/ipc_shm.h
+++ b/Transceiver52M/device/ipc/ipc_shm.h
@@ -0,0 +1,45 @@
+/*
+* Copyright 2020 sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+* Author: Eric Wild <ewild@sysmocom.de>
+*
+* SPDX-License-Identifier: 0BSD
+*
+* Permission to use, copy, modify, and/or distribute this software for any purpose
+* with or without fee is hereby granted.THE SOFTWARE IS PROVIDED "AS IS" AND THE
+* AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR
+* BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF
+* CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+* USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+#ifndef IPC_SHM_H
+#define IPC_SHM_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <shm.h>
+#include <stdint.h>
+
+#ifdef __cplusplus
+}
+#endif
+
+struct ipc_shm_io {
+	volatile struct ipc_shm_raw_stream *this_stream;
+	volatile struct ipc_shm_raw_smpl_buf **volatile buf_ptrs;
+	uint32_t partial_read_begin_ptr;
+};
+
+struct ipc_shm_io *ipc_shm_init_consumer(struct ipc_shm_stream *s);
+struct ipc_shm_io *ipc_shm_init_producer(struct ipc_shm_stream *s);
+void ipc_shm_close(struct ipc_shm_io *r);
+int32_t ipc_shm_enqueue(struct ipc_shm_io *r, uint64_t timestamp, uint32_t len_in_sps, uint16_t *data);
+int32_t ipc_shm_tryenqueue(struct ipc_shm_io *r, uint64_t timestamp, uint32_t len_in_sps, uint16_t *data);
+volatile struct ipc_shm_raw_smpl_buf *ipc_shm_dequeue(struct ipc_shm_io *r);
+int32_t ipc_shm_read(struct ipc_shm_io *r, uint16_t *out_buf, uint32_t num_samples, uint64_t *timestamp,
+		     uint32_t timeout_seconds);
+
+#endif // IPC_SHM_H
--- a/Transceiver52M/device/ipc/ipc_sock.c
+++ b/Transceiver52M/device/ipc/ipc_sock.c
@@ -0,0 +1,266 @@
+/*
+* Copyright 2020 sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+* Author: Pau Espin Pedrol <pespin@sysmocom.de>
+*
+* SPDX-License-Identifier: 0BSD
+*
+* Permission to use, copy, modify, and/or distribute this software for any purpose
+* with or without fee is hereby granted.THE SOFTWARE IS PROVIDED "AS IS" AND THE
+* AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR
+* BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF
+* CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+* USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+#include <assert.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <inttypes.h>
+#include <sys/mman.h>
+#include <sys/stat.h> /* For mode constants */
+#include <fcntl.h> /* For O_* constants */
+
+#include <debug.h>
+#include <osmocom/core/application.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/timer.h>
+
+#include "shm.h"
+#include "ipc-driver-test.h"
+
+extern volatile int ipc_exit_requested;
+static int ipc_rx(uint8_t msg_type, struct ipc_sk_if *ipc_prim)
+{
+	int rc = 0;
+
+	switch (msg_type) {
+	case IPC_IF_MSG_GREETING_REQ:
+		rc = ipc_rx_greeting_req(&ipc_prim->u.greeting_req);
+		break;
+	case IPC_IF_MSG_INFO_REQ:
+		rc = ipc_rx_info_req(&ipc_prim->u.info_req);
+		break;
+	case IPC_IF_MSG_OPEN_REQ:
+		rc = ipc_rx_open_req(&ipc_prim->u.open_req);
+		break;
+	default:
+		LOGP(DDEV, LOGL_ERROR, "Received unknown IPC msg type 0x%02x\n", msg_type);
+		rc = -EINVAL;
+	}
+
+	return rc;
+}
+
+int ipc_sock_send(struct msgb *msg)
+{
+	struct ipc_sock_state *state = global_ipc_sock_state;
+	struct osmo_fd *conn_bfd;
+
+	if (!state) {
+		LOGP(DDEV, LOGL_INFO,
+		     "IPC socket not created, "
+		     "dropping message\n");
+		msgb_free(msg);
+		return -EINVAL;
+	}
+	conn_bfd = &state->conn_bfd;
+	if (conn_bfd->fd <= 0) {
+		LOGP(DDEV, LOGL_NOTICE,
+		     "IPC socket not connected, "
+		     "dropping message\n");
+		msgb_free(msg);
+		return -EIO;
+	}
+	msgb_enqueue(&state->upqueue, msg);
+	osmo_fd_write_enable(conn_bfd);
+
+	return 0;
+}
+
+void ipc_sock_close(struct ipc_sock_state *state)
+{
+	struct osmo_fd *bfd = &state->conn_bfd;
+
+	LOGP(DDEV, LOGL_NOTICE, "IPC socket has LOST connection\n");
+
+	ipc_exit_requested = 1;
+
+	osmo_fd_unregister(bfd);
+	close(bfd->fd);
+	bfd->fd = -1;
+
+	/* re-enable the generation of ACCEPT for new connections */
+	osmo_fd_read_enable(&state->listen_bfd);
+
+	/* flush the queue */
+	while (!llist_empty(&state->upqueue)) {
+		struct msgb *msg = msgb_dequeue(&state->upqueue);
+		msgb_free(msg);
+	}
+}
+
+int ipc_sock_read(struct osmo_fd *bfd)
+{
+	struct ipc_sock_state *state = (struct ipc_sock_state *)bfd->data;
+	struct ipc_sk_if *ipc_prim;
+	struct msgb *msg;
+	int rc;
+
+	msg = msgb_alloc(sizeof(*ipc_prim) + 1000, "ipc_sock_rx");
+	if (!msg)
+		return -ENOMEM;
+
+	ipc_prim = (struct ipc_sk_if *)msg->tail;
+
+	rc = recv(bfd->fd, msg->tail, msgb_tailroom(msg), 0);
+	if (rc == 0)
+		goto close;
+
+	if (rc < 0) {
+		if (errno == EAGAIN) {
+			msgb_free(msg);
+			return 0;
+		}
+		goto close;
+	}
+
+	if (rc < (int)sizeof(*ipc_prim)) {
+		LOGP(DDEV, LOGL_ERROR,
+		     "Received %d bytes on Unix Socket, but primitive size "
+		     "is %zu, discarding\n",
+		     rc, sizeof(*ipc_prim));
+		msgb_free(msg);
+		return 0;
+	}
+
+	rc = ipc_rx(ipc_prim->msg_type, ipc_prim);
+
+	/* as we always synchronously process the message in IPC_rx() and
+	 * its callbacks, we can free the message here. */
+	msgb_free(msg);
+
+	return rc;
+
+close:
+	msgb_free(msg);
+	ipc_sock_close(state);
+	return -1;
+}
+
+static int ipc_sock_write(struct osmo_fd *bfd)
+{
+	struct ipc_sock_state *state = (struct ipc_sock_state *)bfd->data;
+	int rc;
+
+	while (!llist_empty(&state->upqueue)) {
+		struct msgb *msg, *msg2;
+		struct ipc_sk_if *ipc_prim;
+
+		/* peek at the beginning of the queue */
+		msg = llist_entry(state->upqueue.next, struct msgb, list);
+		ipc_prim = (struct ipc_sk_if *)msg->data;
+
+		osmo_fd_write_disable(bfd);
+
+		/* bug hunter 8-): maybe someone forgot msgb_put(...) ? */
+		if (!msgb_length(msg)) {
+			LOGP(DDEV, LOGL_ERROR,
+			     "message type (%d) with ZERO "
+			     "bytes!\n",
+			     ipc_prim->msg_type);
+			goto dontsend;
+		}
+
+		/* try to send it over the socket */
+		rc = write(bfd->fd, msgb_data(msg), msgb_length(msg));
+		if (rc == 0)
+			goto close;
+		if (rc < 0) {
+			if (errno == EAGAIN) {
+				osmo_fd_write_enable(bfd);
+				break;
+			}
+			goto close;
+		}
+
+	dontsend:
+		/* _after_ we send it, we can deueue */
+		msg2 = msgb_dequeue(&state->upqueue);
+		assert(msg == msg2);
+		msgb_free(msg);
+	}
+	return 0;
+
+close:
+	ipc_sock_close(state);
+	return -1;
+}
+
+static int ipc_sock_cb(struct osmo_fd *bfd, unsigned int flags)
+{
+	int rc = 0;
+
+	if (flags & OSMO_FD_READ)
+		rc = ipc_sock_read(bfd);
+	if (rc < 0)
+		return rc;
+
+	if (flags & OSMO_FD_WRITE)
+		rc = ipc_sock_write(bfd);
+
+	return rc;
+}
+
+/* accept connection coming from IPC */
+int ipc_sock_accept(struct osmo_fd *bfd, unsigned int flags)
+{
+	struct ipc_sock_state *state = (struct ipc_sock_state *)bfd->data;
+	struct osmo_fd *conn_bfd = &state->conn_bfd;
+	struct sockaddr_un un_addr;
+	socklen_t len;
+	int rc;
+
+	len = sizeof(un_addr);
+	rc = accept(bfd->fd, (struct sockaddr *)&un_addr, &len);
+	if (rc < 0) {
+		LOGP(DDEV, LOGL_ERROR, "Failed to accept a new connection\n");
+		return -1;
+	}
+
+	if (conn_bfd->fd >= 0) {
+		LOGP(DDEV, LOGL_NOTICE,
+		     "ip clent connects but we already have "
+		     "another active connection ?!?\n");
+		/* We already have one IPC connected, this is all we support */
+		osmo_fd_read_disable(&state->listen_bfd);
+		close(rc);
+		return 0;
+	}
+
+	osmo_fd_setup(conn_bfd, rc, OSMO_FD_READ, ipc_sock_cb, state, 0);
+
+	if (osmo_fd_register(conn_bfd) != 0) {
+		LOGP(DDEV, LOGL_ERROR,
+		     "Failed to register new connection "
+		     "fd\n");
+		close(conn_bfd->fd);
+		conn_bfd->fd = -1;
+		return -1;
+	}
+
+	LOGP(DDEV, LOGL_NOTICE, "Unix socket connected to external osmo-trx\n");
+
+	return 0;
+}
--- a/Transceiver52M/device/ipc/ipc_sock.h
+++ b/Transceiver52M/device/ipc/ipc_sock.h
@@ -0,0 +1,26 @@
+/*
+* Copyright 2020 sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+* Author: Pau Espin Pedrol <pespin@sysmocom.de>
+*
+* SPDX-License-Identifier: 0BSD
+*
+* Permission to use, copy, modify, and/or distribute this software for any purpose
+* with or without fee is hereby granted.THE SOFTWARE IS PROVIDED "AS IS" AND THE
+* AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR
+* BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF
+* CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+* USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+#ifndef IPC_SOCK_H
+#define IPC_SOCK_H
+
+#include "shm.h"
+#include "ipc-driver-test.h"
+
+int ipc_sock_send(struct msgb *msg);
+int ipc_sock_accept(struct osmo_fd *bfd, unsigned int flags);
+void ipc_sock_close(struct ipc_sock_state *state);
+
+#endif // IPC_SOCK_H
--- a/Transceiver52M/device/ipc/shm.c
+++ b/Transceiver52M/device/ipc/shm.c
@@ -0,0 +1,149 @@
+/*
+* Copyright 2020 sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+* Author: Pau Espin Pedrol <pespin@sysmocom.de>
+*
+* SPDX-License-Identifier: 0BSD
+*
+* Permission to use, copy, modify, and/or distribute this software for any purpose
+* with or without fee is hereby granted.THE SOFTWARE IS PROVIDED "AS IS" AND THE
+* AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR
+* BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF
+* CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+* USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+
+#include <stdint.h>
+#include <stddef.h>
+#include <osmocom/core/talloc.h>
+
+#include "shm.h"
+
+#define ENCDECDEBUG(...) //fprintf(stderr, __VA_ARGS__)
+
+/* Convert offsets to pointers */
+struct ipc_shm_stream *ipc_shm_decode_stream(void *tall_ctx, struct ipc_shm_raw_region *root_raw,
+					     struct ipc_shm_raw_stream *stream_raw)
+{
+	unsigned int i;
+	struct ipc_shm_stream *stream;
+	stream = talloc_zero(tall_ctx, struct ipc_shm_stream);
+	stream = talloc_zero_size(tall_ctx, sizeof(struct ipc_shm_stream) +
+						    sizeof(struct ipc_shm_raw_smpl_buf *) * stream_raw->num_buffers);
+	if (!stream)
+		return NULL;
+	stream->num_buffers = stream_raw->num_buffers;
+	stream->buffer_size = stream_raw->buffer_size;
+	stream->raw = stream_raw;
+	for (i = 0; i < stream->num_buffers; i++) {
+		ENCDECDEBUG("decode: smpl_buf %d at offset %u\n", i, stream_raw->buffer_offset[i]);
+		stream->buffers[i] =
+			(struct ipc_shm_raw_smpl_buf *)(((uint8_t *)root_raw) + stream_raw->buffer_offset[i]);
+	}
+	return stream;
+}
+
+struct ipc_shm_channel *ipc_shm_decode_channel(void *tall_ctx, struct ipc_shm_raw_region *root_raw,
+					       struct ipc_shm_raw_channel *chan_raw)
+{
+	struct ipc_shm_channel *chan;
+	chan = talloc_zero(tall_ctx, struct ipc_shm_channel);
+	if (!chan)
+		return NULL;
+	ENCDECDEBUG("decode: streams at offset %u and %u\n", chan_raw->dl_buf_offset, chan_raw->ul_buf_offset);
+	chan->dl_stream = ipc_shm_decode_stream(
+		chan, root_raw, (struct ipc_shm_raw_stream *)(((uint8_t *)root_raw) + chan_raw->dl_buf_offset));
+	chan->ul_stream = ipc_shm_decode_stream(
+		chan, root_raw, (struct ipc_shm_raw_stream *)(((uint8_t *)root_raw) + chan_raw->ul_buf_offset));
+	return chan;
+}
+struct ipc_shm_region *ipc_shm_decode_region(void *tall_ctx, struct ipc_shm_raw_region *root_raw)
+{
+	unsigned int i;
+	struct ipc_shm_region *root;
+	root = talloc_zero_size(tall_ctx,
+				sizeof(struct ipc_shm_region) + sizeof(struct ipc_shm_channel *) * root_raw->num_chans);
+	if (!root)
+		return NULL;
+
+	root->num_chans = root_raw->num_chans;
+	for (i = 0; i < root->num_chans; i++) {
+		ENCDECDEBUG("decode: channel %d at offset %u\n", i, root_raw->chan_offset[i]);
+		root->channels[i] = ipc_shm_decode_channel(
+			root, root_raw,
+			(struct ipc_shm_raw_channel *)(((uint8_t *)root_raw) + root_raw->chan_offset[i]));
+	}
+	return root;
+}
+
+unsigned int ipc_shm_encode_smpl_buf(struct ipc_shm_raw_region *root_raw, struct ipc_shm_raw_smpl_buf *smpl_buf_raw,
+				     uint32_t buffer_size)
+{
+	unsigned int offset = sizeof(struct ipc_shm_raw_smpl_buf);
+	offset = (((uintptr_t)offset + 7) & ~0x07ULL);
+	ENCDECDEBUG("encode: smpl_buf at offset %u\n", offset);
+	offset += buffer_size * sizeof(uint16_t) * 2; /* samples */
+	return offset;
+}
+
+unsigned int ipc_shm_encode_stream(struct ipc_shm_raw_region *root_raw, struct ipc_shm_raw_stream *stream_raw,
+				   uint32_t num_buffers, uint32_t buffer_size)
+{
+	unsigned int i;
+	ptrdiff_t start = (ptrdiff_t)stream_raw;
+	unsigned int offset = sizeof(struct ipc_shm_raw_stream) + sizeof(uint32_t) * num_buffers;
+	offset = (((uintptr_t)offset + 7) & ~0x07ULL);
+	ENCDECDEBUG("encode: stream at offset %lu\n", (start - (ptrdiff_t)root_raw));
+	if (root_raw) {
+		stream_raw->num_buffers = num_buffers;
+		stream_raw->buffer_size = buffer_size;
+		stream_raw->read_next = 0;
+		stream_raw->write_next = 0;
+	}
+	for (i = 0; i < num_buffers; i++) {
+		if (root_raw)
+			stream_raw->buffer_offset[i] = (start + offset - (ptrdiff_t)root_raw);
+		offset +=
+			ipc_shm_encode_smpl_buf(root_raw, (struct ipc_shm_raw_smpl_buf *)(start + offset), buffer_size);
+	}
+	return offset;
+}
+unsigned int ipc_shm_encode_channel(struct ipc_shm_raw_region *root_raw, struct ipc_shm_raw_channel *chan_raw,
+				    uint32_t num_buffers, uint32_t buffer_size)
+{
+	uint8_t *start = (uint8_t *)chan_raw;
+	unsigned int offset = sizeof(struct ipc_shm_raw_channel);
+	offset = (((uintptr_t)offset + 7) & ~0x07ULL);
+	ENCDECDEBUG("encode: channel at offset %lu\n", (start - (uint8_t *)root_raw));
+	if (root_raw)
+		chan_raw->dl_buf_offset = (start + offset - (uint8_t *)root_raw);
+	offset += ipc_shm_encode_stream(root_raw, (struct ipc_shm_raw_stream *)(start + offset), num_buffers,
+					buffer_size);
+	if (root_raw)
+		chan_raw->ul_buf_offset = (start + offset - (uint8_t *)root_raw);
+	offset += ipc_shm_encode_stream(root_raw, (struct ipc_shm_raw_stream *)(start + offset), num_buffers,
+					buffer_size);
+	return offset;
+}
+/* if root_raw is NULL, then do a dry run, aka only calculate final offset */
+unsigned int ipc_shm_encode_region(struct ipc_shm_raw_region *root_raw, uint32_t num_chans, uint32_t num_buffers,
+				   uint32_t buffer_size)
+{
+	unsigned i;
+	uintptr_t start = (uintptr_t)root_raw;
+	unsigned int offset = sizeof(struct ipc_shm_raw_region) + sizeof(uint32_t) * num_chans;
+	offset = (((uintptr_t)offset + 7) & ~0x07ULL);
+
+	if (root_raw)
+		root_raw->num_chans = num_chans;
+	for (i = 0; i < num_chans; i++) {
+		if (root_raw)
+			root_raw->chan_offset[i] = (start + offset - (uintptr_t)root_raw);
+		ENCDECDEBUG("encode: channel %d chan_offset[i]=%lu\n", i, start + offset - (uintptr_t)root_raw);
+		offset += ipc_shm_encode_channel(root_raw, (struct ipc_shm_raw_channel *)(start + offset), num_buffers,
+						 buffer_size);
+	}
+	//TODO: pass maximum size and verify we didn't go through
+	return offset;
+}
--- a/Transceiver52M/device/ipc/shm.h
+++ b/Transceiver52M/device/ipc/shm.h
@@ -0,0 +1,234 @@
+/*
+* Copyright 2020 sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+* Author: Pau Espin Pedrol <pespin@sysmocom.de>
+*
+* SPDX-License-Identifier: 0BSD
+*
+* Permission to use, copy, modify, and/or distribute this software for any purpose
+* with or without fee is hereby granted.THE SOFTWARE IS PROVIDED "AS IS" AND THE
+* AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR
+* BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF
+* CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+* USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+#pragma once
+
+#include <stdint.h>
+#include <unistd.h>
+#include <limits.h>
+#include <pthread.h>
+#include <semaphore.h>
+
+/* RAW structures */
+struct ipc_shm_raw_smpl_buf {
+	uint64_t timestamp;
+	uint32_t data_len; /* In samples */
+	uint16_t samples[0];
+};
+
+struct ipc_shm_raw_stream {
+	pthread_mutex_t lock; /* protects this struct */
+	pthread_cond_t cf; /* signals fill to reader */
+	pthread_cond_t ce; /* signals empty nbuf to writer */
+	uint32_t num_buffers;
+	uint32_t buffer_size; /* In samples */
+	uint32_t read_next;
+	uint32_t write_next;
+	uint32_t buffer_offset[0];
+	//struct ipc_shm_smpl_buf buffers[0];
+};
+
+struct ipc_shm_raw_channel {
+	uint32_t dl_buf_offset;
+	uint32_t ul_buf_offset;
+};
+
+struct ipc_shm_raw_region {
+	uint32_t num_chans;
+	uint32_t chan_offset[0];
+};
+
+/* non-raw, Pointer converted structures */
+struct ipc_shm_stream {
+	uint32_t num_buffers;
+	uint32_t buffer_size;
+	volatile struct ipc_shm_raw_stream *raw;
+	volatile struct ipc_shm_raw_smpl_buf *buffers[0];
+};
+
+struct ipc_shm_channel {
+	struct ipc_shm_stream *dl_stream;
+	struct ipc_shm_stream *ul_stream;
+};
+
+/* Pointer converted structures */
+struct ipc_shm_region {
+	uint32_t num_chans;
+	struct ipc_shm_channel *channels[0];
+};
+
+unsigned int ipc_shm_encode_region(struct ipc_shm_raw_region *root_raw, uint32_t num_chans, uint32_t num_buffers,
+				   uint32_t buffer_size);
+struct ipc_shm_region *ipc_shm_decode_region(void *tall_ctx, struct ipc_shm_raw_region *root_raw);
+/****************************************/
+/* UNIX SOCKET API                      */
+/****************************************/
+
+//////////////////
+// Master socket
+//////////////////
+#define IPC_SOCK_API_VERSION 1
+
+/* msg_type */
+#define IPC_IF_MSG_GREETING_REQ 0x00
+#define IPC_IF_MSG_GREETING_CNF 0x01
+#define IPC_IF_MSG_INFO_REQ 0x02
+#define IPC_IF_MSG_INFO_CNF 0x03
+#define IPC_IF_MSG_OPEN_REQ 0x04
+#define IPC_IF_MSG_OPEN_CNF 0x05
+
+#define MAX_NUM_CHANS 30
+#define RF_PATH_NAME_SIZE 25
+#define MAX_NUM_RF_PATHS 10
+#define SHM_NAME_MAX NAME_MAX /* 255 */
+
+#define FEATURE_MASK_CLOCKREF_INTERNAL (0x1 << 0)
+#define FEATURE_MASK_CLOCKREF_EXTERNAL (0x1 << 1)
+struct ipc_sk_if_info_chan {
+	char tx_path[MAX_NUM_RF_PATHS][RF_PATH_NAME_SIZE];
+	char rx_path[MAX_NUM_RF_PATHS][RF_PATH_NAME_SIZE];
+	double min_rx_gain;
+	double max_rx_gain;
+	double min_tx_gain;
+	double max_tx_gain;
+	double nominal_tx_power; /* dBm */
+} __attribute__((packed));
+
+struct ipc_sk_if_open_req_chan {
+	char tx_path[RF_PATH_NAME_SIZE];
+	char rx_path[RF_PATH_NAME_SIZE];
+} __attribute__((packed));
+
+struct ipc_sk_if_open_cnf_chan {
+	char chan_ipc_sk_path[108];
+} __attribute__((packed));
+
+struct ipc_sk_if_greeting {
+	uint8_t req_version;
+} __attribute__((packed));
+
+struct ipc_sk_if_info_req {
+	uint8_t spare;
+} __attribute__((packed));
+
+struct ipc_sk_if_info_cnf {
+	uint32_t feature_mask;
+	double iq_scaling_val_rx; /* for scaling, sample format is 16 bit, but adc/dac might be less */
+	double iq_scaling_val_tx;
+	uint32_t max_num_chans;
+	char dev_desc[200];
+	struct ipc_sk_if_info_chan chan_info[MAX_NUM_CHANS];
+} __attribute__((packed));
+
+struct ipc_sk_if_open_req {
+	uint32_t num_chans;
+	uint32_t clockref; /* One of FEATUER_MASK_CLOCKREF_* */
+	uint32_t rx_sample_freq_num;
+	uint32_t rx_sample_freq_den;
+	uint32_t tx_sample_freq_num;
+	uint32_t tx_sample_freq_den;
+	uint32_t bandwidth;
+	struct ipc_sk_if_open_req_chan chan_info[MAX_NUM_CHANS];
+} __attribute__((packed));
+
+struct ipc_sk_if_open_cnf {
+	uint8_t return_code;
+	uint32_t path_delay;
+	char shm_name[SHM_NAME_MAX];
+	struct ipc_sk_if_open_cnf_chan chan_info[MAX_NUM_CHANS];
+} __attribute__((packed));
+
+struct ipc_sk_if {
+	uint8_t msg_type; /* message type */
+	uint8_t spare[2];
+
+	union {
+		struct ipc_sk_if_greeting greeting_req;
+		struct ipc_sk_if_greeting greeting_cnf;
+		struct ipc_sk_if_info_req info_req;
+		struct ipc_sk_if_info_cnf info_cnf;
+		struct ipc_sk_if_open_req open_req;
+		struct ipc_sk_if_open_cnf open_cnf;
+	} u;
+} __attribute__((packed));
+
+//////////////////
+// Channel socket
+//////////////////
+#define IPC_IF_CHAN_MSG_OFFSET 50
+#define IPC_IF_MSG_START_REQ IPC_IF_CHAN_MSG_OFFSET + 0
+#define IPC_IF_MSG_START_CNF IPC_IF_CHAN_MSG_OFFSET + 1
+#define IPC_IF_MSG_STOP_REQ IPC_IF_CHAN_MSG_OFFSET + 2
+#define IPC_IF_MSG_STOP_CNF IPC_IF_CHAN_MSG_OFFSET + 3
+#define IPC_IF_MSG_SETGAIN_REQ IPC_IF_CHAN_MSG_OFFSET + 4
+#define IPC_IF_MSG_SETGAIN_CNF IPC_IF_CHAN_MSG_OFFSET + 5
+#define IPC_IF_MSG_SETFREQ_REQ IPC_IF_CHAN_MSG_OFFSET + 6
+#define IPC_IF_MSG_SETFREQ_CNF IPC_IF_CHAN_MSG_OFFSET + 7
+
+#define IPC_IF_NOTIFY_UNDERFLOW IPC_IF_CHAN_MSG_OFFSET + 8
+#define IPC_IF_NOTIFY_OVERFLOW IPC_IF_CHAN_MSG_OFFSET + 9
+
+#define IPC_IF_MSG_SETTXATTN_REQ IPC_IF_CHAN_MSG_OFFSET + 10
+#define IPC_IF_MSG_SETTXATTN_CNF IPC_IF_CHAN_MSG_OFFSET + 11
+
+struct ipc_sk_chan_if_op_void {
+	// at least one dummy byte, to allow c/c++ compatibility
+	uint8_t dummy;
+} __attribute__((packed));
+
+struct ipc_sk_chan_if_op_rc {
+	uint8_t return_code;
+} __attribute__((packed));
+
+struct ipc_sk_chan_if_gain {
+	double gain;
+	uint8_t is_tx;
+} __attribute__((packed));
+
+struct ipc_sk_chan_if_freq_req {
+	double freq;
+	uint8_t is_tx;
+} __attribute__((packed));
+
+struct ipc_sk_chan_if_freq_cnf {
+	uint8_t return_code;
+} __attribute__((packed));
+
+struct ipc_sk_chan_if_notfiy {
+	uint8_t dummy;
+} __attribute__((packed));
+
+struct ipc_sk_chan_if_tx_attenuation {
+	double attenuation;
+} __attribute__((packed));
+
+struct ipc_sk_chan_if {
+	uint8_t msg_type; /* message type */
+	uint8_t spare[2];
+
+	union {
+		struct ipc_sk_chan_if_op_void start_req;
+		struct ipc_sk_chan_if_op_rc start_cnf;
+		struct ipc_sk_chan_if_op_void stop_req;
+		struct ipc_sk_chan_if_op_rc stop_cnf;
+		struct ipc_sk_chan_if_gain set_gain_req;
+		struct ipc_sk_chan_if_gain set_gain_cnf;
+		struct ipc_sk_chan_if_freq_req set_freq_req;
+		struct ipc_sk_chan_if_freq_cnf set_freq_cnf;
+		struct ipc_sk_chan_if_notfiy notify;
+		struct ipc_sk_chan_if_tx_attenuation txatten_req;
+		struct ipc_sk_chan_if_tx_attenuation txatten_cnf;
+	} u;
+} __attribute__((packed));
--- a/Transceiver52M/device/ipc/uhdwrap.cpp
+++ b/Transceiver52M/device/ipc/uhdwrap.cpp
@@ -0,0 +1,255 @@
+/*
+* Copyright 2020 sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+* Author: Eric Wild <ewild@sysmocom.de>
+*
+* SPDX-License-Identifier: 0BSD
+*
+* Permission to use, copy, modify, and/or distribute this software for any purpose
+* with or without fee is hereby granted.THE SOFTWARE IS PROVIDED "AS IS" AND THE
+* AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR
+* BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF
+* CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+* USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+extern "C" {
+#include <osmocom/core/application.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/timer.h>
+
+#include "shm.h"
+#include "ipc_shm.h"
+#include "ipc-driver-test.h"
+}
+#include "../uhd/UHDDevice.h"
+#include "uhdwrap.h"
+
+#include "Logger.h"
+#include "Threads.h"
+#include "Utils.h"
+
+// no vty source for cfg params here, so we have to build our own
+static struct trx_cfg actual_cfg = {};
+
+int uhd_wrap::open()
+{
+	int rv = uhd_device::open();
+	samps_per_buff_rx = rx_stream->get_max_num_samps();
+	samps_per_buff_tx = tx_stream->get_max_num_samps();
+	channel_count = usrp_dev->get_rx_num_channels();
+
+	wrap_rx_buffs = std::vector<std::vector<short> >(channel_count, std::vector<short>(2 * samps_per_buff_rx));
+	for (size_t i = 0; i < wrap_rx_buffs.size(); i++)
+		wrap_rx_buf_ptrs.push_back(&wrap_rx_buffs[i].front());
+
+	wrap_tx_buffs = std::vector<std::vector<short> >(channel_count, std::vector<short>(2 * 5000));
+	for (size_t i = 0; i < wrap_tx_buffs.size(); i++)
+		wrap_tx_buf_ptrs.push_back(&wrap_tx_buffs[i].front());
+
+	return rv;
+}
+
+uhd_wrap::~uhd_wrap()
+{
+	//	drvtest::gshutdown = 1;
+	//t->join();
+}
+
+size_t uhd_wrap::bufsizerx()
+{
+	return samps_per_buff_rx;
+}
+
+size_t uhd_wrap::bufsizetx()
+{
+	return samps_per_buff_tx;
+}
+
+int uhd_wrap::chancount()
+{
+	return channel_count;
+}
+
+int uhd_wrap::wrap_read(TIMESTAMP *timestamp)
+{
+	uhd::rx_metadata_t md;
+	size_t num_rx_samps = rx_stream->recv(wrap_rx_buf_ptrs, samps_per_buff_rx, md, 0.1, true);
+	*timestamp = md.time_spec.to_ticks(rx_rate);
+	return num_rx_samps; //uhd_device::readSamples(bufs, len, overrun, timestamp, underrun);
+}
+
+extern "C" void *uhdwrap_open(struct ipc_sk_if_open_req *open_req)
+{
+	actual_cfg.num_chans = open_req->num_chans;
+	actual_cfg.swap_channels = false;
+	/* FIXME: this is actually the sps value, not the sample rate!
+	 * sample rate is looked up according to the sps rate by uhd backend */
+	actual_cfg.rx_sps = open_req->rx_sample_freq_num / open_req->rx_sample_freq_den;
+	actual_cfg.tx_sps = open_req->tx_sample_freq_num / open_req->tx_sample_freq_den;
+
+	/* FIXME: dev arg string* */
+	/* FIXME: rx frontend bw? */
+	/* FIXME: tx frontend bw? */
+	switch (open_req->clockref) {
+	case FEATURE_MASK_CLOCKREF_EXTERNAL:
+		actual_cfg.clock_ref = ReferenceType::REF_EXTERNAL;
+		break;
+	case FEATURE_MASK_CLOCKREF_INTERNAL:
+	default:
+		actual_cfg.clock_ref = ReferenceType::REF_INTERNAL;
+		break;
+	}
+
+	for (unsigned int i = 0; i < open_req->num_chans; i++) {
+		actual_cfg.chans[i].rx_path = open_req->chan_info[i].tx_path;
+		actual_cfg.chans[i].tx_path = open_req->chan_info[i].rx_path;
+	}
+
+	uhd_wrap *uhd_wrap_dev = new uhd_wrap(RadioDevice::NORMAL, &actual_cfg);
+	uhd_wrap_dev->open();
+
+	return uhd_wrap_dev;
+}
+extern "C" int32_t uhdwrap_get_bufsizerx(void *dev)
+{
+	uhd_wrap *d = (uhd_wrap *)dev;
+	return d->bufsizerx();
+}
+
+extern "C" int32_t uhdwrap_get_timingoffset(void *dev)
+{
+	uhd_wrap *d = (uhd_wrap *)dev;
+	return d->getTimingOffset();
+}
+
+extern "C" int32_t uhdwrap_read(void *dev, uint32_t num_chans)
+{
+	TIMESTAMP t;
+	uhd_wrap *d = (uhd_wrap *)dev;
+
+	if (num_chans != d->wrap_rx_buf_ptrs.size()) {
+		perror("omg chans?!");
+	}
+
+	int32_t read = d->wrap_read(&t);
+
+	/* multi channel rx on b210 will return 0 due to alignment adventures, do not put 0 samples into a ipc buffer... */
+	if (read <= 0)
+		return read;
+
+	for (uint32_t i = 0; i < num_chans; i++) {
+		ipc_shm_enqueue(ios_rx_from_device[i], t, read, (uint16_t *)&d->wrap_rx_buffs[i].front());
+	}
+	return read;
+}
+
+extern "C" int32_t uhdwrap_write(void *dev, uint32_t num_chans, bool *underrun)
+{
+	uhd_wrap *d = (uhd_wrap *)dev;
+
+	uint64_t timestamp;
+	int32_t len = -1;
+	for (uint32_t i = 0; i < num_chans; i++) {
+		len = ipc_shm_read(ios_tx_to_device[i], (uint16_t *)&d->wrap_tx_buffs[i].front(), 5000, &timestamp, 1);
+		if (len < 0)
+			return 0;
+	}
+
+	return d->writeSamples(d->wrap_tx_buf_ptrs, len, underrun, timestamp);
+}
+
+extern "C" double uhdwrap_set_freq(void *dev, double f, size_t chan, bool for_tx)
+{
+	uhd_wrap *d = (uhd_wrap *)dev;
+	if (for_tx)
+		return d->setTxFreq(f, chan);
+	else
+		return d->setRxFreq(f, chan);
+}
+
+extern "C" double uhdwrap_set_gain(void *dev, double f, size_t chan, bool for_tx)
+{
+	uhd_wrap *d = (uhd_wrap *)dev;
+	//	if (for_tx)
+	//		return d->setTxGain(f, chan);
+	//	else
+	return d->setRxGain(f, chan);
+}
+
+extern "C" double uhdwrap_set_txatt(void *dev, double a, size_t chan)
+{
+	uhd_wrap *d = (uhd_wrap *)dev;
+	return d->setPowerAttenuation(a, chan);
+}
+
+extern "C" int32_t uhdwrap_start(void *dev, int chan)
+{
+	uhd_wrap *d = (uhd_wrap *)dev;
+	return d->start();
+}
+
+extern "C" int32_t uhdwrap_stop(void *dev, int chan)
+{
+	uhd_wrap *d = (uhd_wrap *)dev;
+	return d->stop();
+}
+
+extern "C" void uhdwrap_fill_info_cnf(struct ipc_sk_if *ipc_prim)
+{
+	struct ipc_sk_if_info_chan *chan_info;
+
+	uhd::device_addr_t args("");
+	uhd::device_addrs_t devs_found = uhd::device::find(args);
+	if (devs_found.size() < 1) {
+		std::cout << "\n No device found!";
+		exit(0);
+	}
+
+	uhd::usrp::multi_usrp::sptr usrp = uhd::usrp::multi_usrp::make(devs_found[0]);
+	auto rxchans = usrp->get_rx_num_channels();
+	auto txchans = usrp->get_tx_num_channels();
+	auto rx_range = usrp->get_rx_gain_range();
+	auto tx_range = usrp->get_tx_gain_range();
+
+	//auto nboards = usrp->get_num_mboards();
+	auto refs = usrp->get_clock_sources(0);
+	auto devname = usrp->get_mboard_name(0);
+
+	ipc_prim->u.info_cnf.feature_mask = 0;
+	if (std::find(refs.begin(), refs.end(), "internal") != refs.end())
+		ipc_prim->u.info_cnf.feature_mask |= FEATURE_MASK_CLOCKREF_INTERNAL;
+	if (std::find(refs.begin(), refs.end(), "external") != refs.end())
+		ipc_prim->u.info_cnf.feature_mask |= FEATURE_MASK_CLOCKREF_EXTERNAL;
+
+	// at least one duplex channel
+	auto num_chans = rxchans == txchans ? txchans : 1;
+
+	ipc_prim->u.info_cnf.iq_scaling_val_rx = 0.3;
+	ipc_prim->u.info_cnf.iq_scaling_val_tx = 1;
+	ipc_prim->u.info_cnf.max_num_chans = num_chans;
+	OSMO_STRLCPY_ARRAY(ipc_prim->u.info_cnf.dev_desc, devname.c_str());
+	chan_info = ipc_prim->u.info_cnf.chan_info;
+	for (unsigned int i = 0; i < ipc_prim->u.info_cnf.max_num_chans; i++) {
+		auto rxant = usrp->get_rx_antennas(i);
+		auto txant = usrp->get_tx_antennas(i);
+		for (unsigned int j = 0; j < txant.size(); j++) {
+			OSMO_STRLCPY_ARRAY(chan_info->tx_path[j], txant[j].c_str());
+		}
+		for (unsigned int j = 0; j < rxant.size(); j++) {
+			OSMO_STRLCPY_ARRAY(chan_info->rx_path[j], rxant[j].c_str());
+		}
+		chan_info->min_rx_gain = rx_range.start();
+		chan_info->max_rx_gain = rx_range.stop();
+		chan_info->min_tx_gain = tx_range.start();
+		chan_info->max_tx_gain = tx_range.stop();
+		chan_info->nominal_tx_power = 7.5; // FIXME: would require uhd dev + freq info
+		chan_info++;
+	}
+}
--- a/Transceiver52M/device/ipc/uhdwrap.h
+++ b/Transceiver52M/device/ipc/uhdwrap.h
@@ -0,0 +1,83 @@
+/*
+* Copyright 2020 sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+* Author: Eric Wild <ewild@sysmocom.de>
+*
+* SPDX-License-Identifier: 0BSD
+*
+* Permission to use, copy, modify, and/or distribute this software for any purpose
+* with or without fee is hereby granted.THE SOFTWARE IS PROVIDED "AS IS" AND THE
+* AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR
+* BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF
+* CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+* USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+#ifndef IPC_UHDWRAP_H
+#define IPC_UHDWRAP_H
+
+#ifdef __cplusplus
+#include "../uhd/UHDDevice.h"
+
+class uhd_wrap : public uhd_device {
+    public:
+	//	std::thread *t;
+	size_t samps_per_buff_rx;
+	size_t samps_per_buff_tx;
+	int channel_count;
+
+	std::vector<std::vector<short> > wrap_rx_buffs;
+	std::vector<std::vector<short> > wrap_tx_buffs;
+	std::vector<short *> wrap_rx_buf_ptrs;
+	std::vector<short *> wrap_tx_buf_ptrs;
+
+	template <typename... Args> uhd_wrap(Args... args) : uhd_device(args...)
+	{
+		//	t = new std::thread(magicthread);
+		// give the thread some time to start and set up
+		//	std::this_thread::sleep_for(std::chrono::seconds(1));
+	}
+	virtual ~uhd_wrap();
+
+	//    void ipc_sock_close() override {};
+	int wrap_read(TIMESTAMP *timestamp);
+	virtual int open() override;
+
+	//	bool start() override;
+	//	bool stop() override;
+	//	virtual TIMESTAMP initialWriteTimestamp() override;
+	//	virtual TIMESTAMP initialReadTimestamp() override;
+
+	int getTimingOffset()
+	{
+		return ts_offset;
+	}
+	size_t bufsizerx();
+	size_t bufsizetx();
+	int chancount();
+};
+#else
+void *uhdwrap_open(struct ipc_sk_if_open_req *open_req);
+
+int32_t uhdwrap_get_bufsizerx(void *dev);
+
+int32_t uhdwrap_get_timingoffset(void *dev);
+
+int32_t uhdwrap_read(void *dev, uint32_t num_chans);
+
+int32_t uhdwrap_write(void *dev, uint32_t num_chans, bool *underrun);
+
+double uhdwrap_set_freq(void *dev, double f, size_t chan, bool for_tx);
+
+double uhdwrap_set_gain(void *dev, double f, size_t chan, bool for_tx);
+
+int32_t uhdwrap_start(void *dev, int chan);
+
+int32_t uhdwrap_stop(void *dev, int chan);
+
+void uhdwrap_fill_info_cnf(struct ipc_sk_if *ipc_prim);
+
+double uhdwrap_set_txatt(void *dev, double a, size_t chan);
+#endif
+
+#endif // IPC_B210_H
--- a/Transceiver52M/device/lms/LMSDevice.cpp
+++ b/Transceiver52M/device/lms/LMSDevice.cpp
@@ -23,7 +23,6 @@

 #include <map>

-#include "trx_vty.h"
 #include "Logger.h"
 #include "Threads.h"
 #include "LMSDevice.h"
@@ -32,6 +31,7 @@
 #include <lime/LimeSuite.h>

 extern "C" {
+#include "trx_vty.h"
 #include "osmo_signal.h"
 #include <osmocom/core/utils.h>
 }
@@ -40,8 +40,6 @@ extern "C" {
 #include "config.h"
 #endif

-using namespace std;
-
 #define MAX_ANTENNA_LIST_SIZE 10
 #define GSM_CARRIER_BW 270000.0 /* 270kHz */
 #define LMS_MIN_BW_SUPPORTED 2.5e6 /* 2.5mHz, minimum supported by LMS */
@@ -54,38 +52,42 @@ using namespace std;
 #define LMS_DEV_SDR_MINI_PREFIX_NAME "LimeSDR-Mini"
 #define LMS_DEV_NET_MICRO_PREFIX_NAME "LimeNET-Micro"

-/* Device parameter descriptor */
-struct dev_desc {
-	/* Does LimeSuite allow switching the clock source for this device?
-	 * LimeSDR-Mini does not have switches but needs soldering to select
-	 * external/internal clock. Any call to LMS_SetClockFreq() will fail.
-	 */
-	bool clock_src_switchable;
-	/* Does LimeSuite allow using REF_INTERNAL for this device?
-	 * LimeNET-Micro does not like selecting internal clock
-	 */
-	bool clock_src_int_usable;
-	/* Device specific maximum tx levels selected by phasenoise measurements, in dB */
-	double max_tx_gain;
-	/* Sample rate coef (without having TX/RX samples per symbol into account) */
-	double rate;
-	/* Sample rate coef (without having TX/RX samples per symbol into account), if multi-arfcn is enabled */
-	double rate_multiarfcn;
-	/* Coefficient multiplied by TX sample rate in order to shift Tx time */
-	double ts_offset_coef;
-	/* Coefficient multiplied by TX sample rate in order to shift Tx time, if multi-arfcn is enabled */
-	double ts_offset_coef_multiarfcn;
-	/* Device Name Prefix as presented by LimeSuite API LMS_GetDeviceInfo() */
-	std::string name_prefix;
+
+
+static const dev_map_t dev_param_map {
+	{ LMS_DEV_SDR_USB,   { true,  true,  GSMRATE, MCBTS_SPACING, 8.9e-5, 7.9e-5, LMS_DEV_SDR_USB_PREFIX_NAME } },
+	{ LMS_DEV_SDR_MINI,  { false, true,  GSMRATE, MCBTS_SPACING, 8.9e-5, 8.2e-5, LMS_DEV_SDR_MINI_PREFIX_NAME } },
+	{ LMS_DEV_NET_MICRO, { true,  false, GSMRATE, MCBTS_SPACING, 8.9e-5, 7.9e-5, LMS_DEV_NET_MICRO_PREFIX_NAME } },
+	{ LMS_DEV_UNKNOWN,   { true,  true,  GSMRATE, MCBTS_SPACING, 8.9e-5, 7.9e-5, "UNKNOWN" } },
 };

-static const std::map<enum lms_dev_type, struct dev_desc> dev_param_map {
-	{ LMS_DEV_SDR_USB,   { true,  true,  73.0, GSMRATE, MCBTS_SPACING, 8.9e-5, 7.9e-5, LMS_DEV_SDR_USB_PREFIX_NAME } },
-	{ LMS_DEV_SDR_MINI,  { false, true,  66.0, GSMRATE, MCBTS_SPACING, 8.9e-5, 8.2e-5, LMS_DEV_SDR_MINI_PREFIX_NAME } },
-	{ LMS_DEV_NET_MICRO, { true,  false, 71.0, GSMRATE, MCBTS_SPACING, 8.9e-5, 7.9e-5, LMS_DEV_NET_MICRO_PREFIX_NAME } },
-	{ LMS_DEV_UNKNOWN,   { true,  true,  73.0, GSMRATE, MCBTS_SPACING, 8.9e-5, 7.9e-5, "UNKNOWN" } },
+static const power_map_t dev_band_nom_power_param_map {
+	{ std::make_tuple(LMS_DEV_SDR_USB, GSM_BAND_850),	{ 73.0, 11.2,  -6.0  } },
+	{ std::make_tuple(LMS_DEV_SDR_USB, GSM_BAND_900),	{ 73.0, 10.8,  -6.0  } },
+	{ std::make_tuple(LMS_DEV_SDR_USB, GSM_BAND_1800),	{ 65.0, -3.5,  -17.0 } }, /* FIXME: OS#4583: 1800Mhz is failing above TxGain=65, which is around -3.5dBm (already < 0 dBm) */
+	{ std::make_tuple(LMS_DEV_SDR_USB, GSM_BAND_1900),	{ 73.0, 1.7,   -17.0 } }, /* FIXME: OS#4583: 1900MHz is failing in all TxGain values */
+	{ std::make_tuple(LMS_DEV_SDR_MINI, GSM_BAND_850),	{ 66.0, 3.1,   -6.0  } }, /* FIXME: OS#4583: Ensure BAND2 is used at startup */
+	{ std::make_tuple(LMS_DEV_SDR_MINI, GSM_BAND_900),	{ 66.0, 2.8,   -6.0  } }, /* FIXME: OS#4583: Ensure BAND2 is used at startup */
+	{ std::make_tuple(LMS_DEV_SDR_MINI, GSM_BAND_1800),	{ 66.0, -11.6, -17.0 } }, /* OS#4583: Any of BAND1 or BAND2 is fine */
+	{ std::make_tuple(LMS_DEV_SDR_MINI, GSM_BAND_1900),	{ 66.0, -9.2,  -17.0 } }, /* FIXME: OS#4583: Ensure BAND1 is used at startup */
+	{ std::make_tuple(LMS_DEV_NET_MICRO, GSM_BAND_850),	{ 71.0, 6.8,   -6.0  } },
+	{ std::make_tuple(LMS_DEV_NET_MICRO, GSM_BAND_900),	{ 71.0, 6.8,   -6.0  } },
+	{ std::make_tuple(LMS_DEV_NET_MICRO, GSM_BAND_1800),	{ 65.0, -10.5, -17.0 } }, /* OS#4583: TxGain=71 (-4.4dBm) FAIL rms phase errors ~10° */
+	{ std::make_tuple(LMS_DEV_NET_MICRO, GSM_BAND_1900),	{ 71.0, -6.3,  -17.0 } }, /* FIXME: OS#4583: all FAIL, BAND1/BAND2 rms phase errors >23° */
 };

+/* So far measurements done for B210 show really close to linear relationship
+ * between gain and real output power, so we simply adjust the measured offset
+ */
+static double TxGain2TxPower(const dev_band_desc &desc, double tx_gain_db)
+{
+	return desc.nom_out_tx_power - (desc.nom_lms_tx_gain - tx_gain_db);
+}
+static double TxPower2TxGain(const dev_band_desc &desc, double tx_power_dbm)
+{
+	return desc.nom_lms_tx_gain - (desc.nom_out_tx_power - tx_power_dbm);
+}
+
 static enum lms_dev_type parse_dev_type(lms_device_t *m_lms_dev)
 {
 	std::map<enum lms_dev_type, struct dev_desc>::const_iterator it = dev_param_map.begin();
@@ -97,8 +99,8 @@ static enum lms_dev_type parse_dev_type(lms_device_t *m_lms_dev)
 		enum lms_dev_type dev_type = it->first;
 		struct dev_desc desc = it->second;

-		if (strncmp(device_info->deviceName, desc.name_prefix.c_str(), desc.name_prefix.length()) == 0) {
-			LOGC(DDEV, INFO) << "Device identified as " << desc.name_prefix;
+		if (strncmp(device_info->deviceName, desc.desc_str.c_str(), desc.desc_str.length()) == 0) {
+			LOGC(DDEV, INFO) << "Device identified as " << desc.desc_str;
 			return dev_type;
 		}
 		it++;
@@ -106,11 +108,10 @@ static enum lms_dev_type parse_dev_type(lms_device_t *m_lms_dev)
 	return LMS_DEV_UNKNOWN;
 }

-LMSDevice::LMSDevice(size_t tx_sps, size_t rx_sps, InterfaceType iface, size_t chan_num, double lo_offset,
-		     const std::vector<std::string>& tx_paths,
-		     const std::vector<std::string>& rx_paths):
-	RadioDevice(tx_sps, rx_sps, iface, chan_num, lo_offset, tx_paths, rx_paths),
-	m_lms_dev(NULL), started(false), m_dev_type(LMS_DEV_UNKNOWN)
+LMSDevice::LMSDevice(InterfaceType iface, const struct trx_cfg *cfg)
+	: RadioDevice(iface, cfg),
+	  band_manager(m_dev_type, dev_band_nom_power_param_map, dev_param_map, {LMS_DEV_SDR_USB, GSM_BAND_850}), m_lms_dev(NULL),
+	  started(false), m_dev_type(LMS_DEV_UNKNOWN)
 {
 	LOGC(DDEV, INFO) << "creating LMS device...";

@@ -176,7 +177,7 @@ static void print_range(const char* name, lms_range_t *range)
 int info_list_find(lms_info_str_t* info_list, unsigned int count, const std::string &args)
 {
 	unsigned int i, j;
-	std::vector<string> filters;
+	std::vector<std::string> filters;

 	filters = comma_delimited_to_vector(args.c_str());

@@ -197,7 +198,7 @@ int info_list_find(lms_info_str_t* info_list, unsigned int count, const std::str
 	return -1;
 }

-int LMSDevice::open(const std::string &args, int ref, bool swap_channels)
+int LMSDevice::open()
 {
 	lms_info_str_t* info_list;
 	lms_range_t range_sr;
@@ -210,11 +211,12 @@ int LMSDevice::open(const std::string &args, int ref, bool swap_channels)

 	LMS_RegisterLogHandler(&lms_log_callback);

-	if ((n = LMS_GetDeviceList(NULL)) < 0)
+	if ((rc = LMS_GetDeviceList(NULL)) < 0)
 		LOGC(DDEV, ERROR) << "LMS_GetDeviceList(NULL) failed";
-	LOGC(DDEV, INFO) << "Devices found: " << n;
-	if (n < 1)
+	LOGC(DDEV, INFO) << "Devices found: " << rc;
+	if (rc < 1)
 	    return -1;
+	n = rc;

 	info_list = new lms_info_str_t[n];

@@ -224,9 +226,9 @@ int LMSDevice::open(const std::string &args, int ref, bool swap_channels)
 	for (i = 0; i < n; i++)
 		LOGC(DDEV, INFO) << "Device [" << i << "]: " << info_list[i];

-	dev_id = info_list_find(info_list, n, args);
+	dev_id = info_list_find(info_list, n, cfg->dev_args);
 	if (dev_id == -1) {
-		LOGC(DDEV, ERROR) << "No LMS device found with address '" << args << "'";
+		LOGC(DDEV, ERROR) << "No LMS device found with address '" << cfg->dev_args << "'";
 		delete[] info_list;
 		return -1;
 	}
@@ -243,14 +245,15 @@ int LMSDevice::open(const std::string &args, int ref, bool swap_channels)

 	m_dev_type = parse_dev_type(m_lms_dev);
 	dev_desc = dev_param_map.at(m_dev_type);
+	update_band_dev(m_dev_type);

-	if ((ref != REF_EXTERNAL) && (ref != REF_INTERNAL)){
+	if ((cfg->clock_ref != REF_EXTERNAL) && (cfg->clock_ref != REF_INTERNAL)) {
 		LOGC(DDEV, ERROR) << "Invalid reference type";
 		goto out_close;
 	}

 	/* if reference clock is external, setup must happen _before_ calling LMS_Init */
-	if (ref == REF_EXTERNAL) {
+	if (cfg->clock_ref == REF_EXTERNAL) {
 		LOGC(DDEV, INFO) << "Setting External clock reference to 10MHz";
 		/* FIXME: Assume an external 10 MHz reference clock. make
 		   external reference frequency configurable */
@@ -265,7 +268,7 @@ int LMSDevice::open(const std::string &args, int ref, bool swap_channels)
 	}

 	/* if reference clock is internal, setup must happen _after_ calling LMS_Init */
-	if (ref == REF_INTERNAL) {
+	if (cfg->clock_ref == REF_INTERNAL) {
 		LOGC(DDEV, INFO) << "Setting Internal clock reference";
 		/* Internal freq param is not used */
 		if (!do_clock_src_freq(REF_INTERNAL, 0))
@@ -322,17 +325,20 @@ bool LMSDevice::start()
 	LOGC(DDEV, INFO) << "starting LMS...";

 	unsigned int i;
+	dev_band_desc desc;

 	if (started) {
 		LOGC(DDEV, ERR) << "Device already started";
 		return false;
 	}

+	get_dev_band_desc(desc);
+
 	/* configure the channels/streams */
 	for (i=0; i<chans; i++) {
 		/* Set gains for calibration/filter setup */
 		/* TX gain to maximum */
-		setTxGain(maxTxGain(), i);
+		LMS_SetGaindB(m_lms_dev, LMS_CH_TX, i, TxPower2TxGain(desc, desc.nom_out_tx_power));
 		/* RX gain to midpoint */
 		setRxGain((minRxGain() + maxRxGain()) / 2, i);

@@ -398,6 +404,8 @@ bool LMSDevice::stop()
 		LMS_DestroyStream(m_lms_dev, &m_lms_stream_rx[i]);
 	}

+	band_reset();
+
 	started = false;
 	return true;
 }
@@ -413,8 +421,8 @@ bool LMSDevice::do_clock_src_freq(enum ReferenceType ref, double freq)
 		break;
 	case REF_INTERNAL:
 		if (!dev_desc.clock_src_int_usable) {
-			LOGC(DDEV, ERROR) << "Device type " << dev_desc.name_prefix
-					  << " doesn't support internal reference clock";
+			LOGC(DDEV, ERROR)
+				<< "Device type " << dev_desc.desc_str << " doesn't support internal reference clock";
 			return false;
 		}
 		/* According to lms using LMS_CLOCK_EXTREF with a
@@ -432,8 +440,8 @@ bool LMSDevice::do_clock_src_freq(enum ReferenceType ref, double freq)
 		if (LMS_SetClockFreq(m_lms_dev, lms_clk_id, freq) < 0)
 			return false;
 	} else {
-		LOGC(DDEV, INFO) << "Device type " << dev_desc.name_prefix
-				 << " doesn't support switching clock source through SW";
+		LOGC(DDEV, INFO)
+			<< "Device type " << dev_desc.desc_str << " doesn't support switching clock source through SW";
 	}

 	return true;
@@ -477,17 +485,6 @@ bool LMSDevice::do_filters(size_t chan)
 	return true;
 }

-
-double LMSDevice::maxTxGain()
-{
-	return dev_param_map.at(m_dev_type).max_tx_gain;
-}
-
-double LMSDevice::minTxGain()
-{
-	return 0.0;
-}
-
 double LMSDevice::maxRxGain()
 {
 	return 73.0;
@@ -498,22 +495,6 @@ double LMSDevice::minRxGain()
 	return 0.0;
 }

-double LMSDevice::setTxGain(double dB, size_t chan)
-{
-	if (dB > maxTxGain())
-		dB = maxTxGain();
-	if (dB < minTxGain())
-		dB = minTxGain();
-
-	LOGCHAN(chan, DDEV, NOTICE) << "Setting TX gain to " << dB << " dB";
-
-	if (LMS_SetGaindB(m_lms_dev, LMS_CH_TX, chan, dB) < 0)
-		LOGCHAN(chan, DDEV, ERR) << "Error setting TX gain to " << dB << " dB";
-	else
-		tx_gains[chan] = dB;
-	return tx_gains[chan];
-}
-
 double LMSDevice::setRxGain(double dB, size_t chan)
 {
 	if (dB > maxRxGain())
@@ -530,6 +511,63 @@ double LMSDevice::setRxGain(double dB, size_t chan)
 	return rx_gains[chan];
 }

+double LMSDevice::rssiOffset(size_t chan)
+{
+	double rssiOffset;
+	dev_band_desc desc;
+
+	if (chan >= rx_gains.size()) {
+		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
+		return 0.0f;
+	}
+
+	get_dev_band_desc(desc);
+	rssiOffset = rx_gains[chan] + desc.rxgain2rssioffset_rel;
+	return rssiOffset;
+}
+
+double LMSDevice::setPowerAttenuation(int atten, size_t chan)
+{
+	double tx_power, dB;
+	dev_band_desc desc;
+
+	if (chan >= tx_gains.size()) {
+		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
+		return 0.0f;
+	}
+
+	get_dev_band_desc(desc);
+	tx_power = desc.nom_out_tx_power - atten;
+	dB = TxPower2TxGain(desc, tx_power);
+
+	LOGCHAN(chan, DDEV, NOTICE) << "Setting TX gain to " << dB << " dB (~" << tx_power << " dBm)";
+
+	if (LMS_SetGaindB(m_lms_dev, LMS_CH_TX, chan, dB) < 0)
+		LOGCHAN(chan, DDEV, ERR) << "Error setting TX gain to " << dB << " dB (~" << tx_power << " dBm)";
+	else
+		tx_gains[chan] = dB;
+	return desc.nom_out_tx_power - TxGain2TxPower(desc, tx_gains[chan]);
+}
+
+double LMSDevice::getPowerAttenuation(size_t chan) {
+	dev_band_desc desc;
+	if (chan >= tx_gains.size()) {
+		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
+		return 0.0f;
+	}
+
+	get_dev_band_desc(desc);
+	return desc.nom_out_tx_power - TxGain2TxPower(desc, tx_gains[chan]);
+}
+
+int LMSDevice::getNominalTxPower(size_t chan)
+{
+	dev_band_desc desc;
+	get_dev_band_desc(desc);
+
+	return desc.nom_out_tx_power;
+}
+
 void LMSDevice::log_ant_list(bool dir_tx, size_t chan, std::ostringstream& os)
 {
 	lms_name_t name_list[MAX_ANTENNA_LIST_SIZE]; /* large enough list for antenna names. */
@@ -896,8 +934,16 @@ bool LMSDevice::updateAlignment(TIMESTAMP timestamp)

 bool LMSDevice::setTxFreq(double wFreq, size_t chan)
 {
+	if (chan >= chans) {
+		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
+		return false;
+	}
+
 	LOGCHAN(chan, DDEV, NOTICE) << "Setting Tx Freq to " << wFreq << " Hz";

+	if (!update_band_from_freq(wFreq, chan, true))
+		return false;
+
 	if (LMS_SetLOFrequency(m_lms_dev, LMS_CH_TX, chan, wFreq) < 0) {
 		LOGCHAN(chan, DDEV, ERROR) << "Error setting Tx Freq to " << wFreq << " Hz";
 		return false;
@@ -910,6 +956,9 @@ bool LMSDevice::setRxFreq(double wFreq, size_t chan)
 {
 	LOGCHAN(chan, DDEV, NOTICE) << "Setting Rx Freq to " << wFreq << " Hz";

+	if (!update_band_from_freq(wFreq, chan, false))
+		return false;
+
 	if (LMS_SetLOFrequency(m_lms_dev, LMS_CH_RX, chan, wFreq) < 0) {
 		LOGCHAN(chan, DDEV, ERROR) << "Error setting Rx Freq to " << wFreq << " Hz";
 		return false;
@@ -918,18 +967,15 @@ bool LMSDevice::setRxFreq(double wFreq, size_t chan)
 	return true;
 }

-RadioDevice *RadioDevice::make(size_t tx_sps, size_t rx_sps,
-			       InterfaceType iface, size_t chans, double lo_offset,
-			       const std::vector < std::string > &tx_paths,
-			       const std::vector < std::string > &rx_paths)
+RadioDevice *RadioDevice::make(InterfaceType type, const struct trx_cfg *cfg)
 {
-	if (tx_sps != rx_sps) {
-		LOGC(DDEV, ERROR) << "LMS Requires tx_sps == rx_sps";
+	if (cfg->tx_sps != cfg->rx_sps) {
+		LOGC(DDEV, ERROR) << "LMS requires tx_sps == rx_sps";
 		return NULL;
 	}
-	if (lo_offset != 0.0) {
+	if (cfg->offset != 0.0) {
 		LOGC(DDEV, ERROR) << "LMS doesn't support lo_offset";
 		return NULL;
 	}
-	return new LMSDevice(tx_sps, rx_sps, iface, chans, lo_offset, tx_paths, rx_paths);
+	return new LMSDevice(type, cfg);
 }
--- a/Transceiver52M/device/lms/LMSDevice.h
+++ b/Transceiver52M/device/lms/LMSDevice.h
@@ -18,11 +18,13 @@
 #ifndef _LMS_DEVICE_H_
 #define _LMS_DEVICE_H_

+#include <map>
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif

 #include "radioDevice.h"
+#include "bandmanager.h"
 #include "smpl_buf.h"

 #include <sys/time.h>
@@ -32,6 +34,10 @@
 #include <iostream>
 #include <lime/LimeSuite.h>

+extern "C" {
+#include <osmocom/gsm/gsm_utils.h>
+}
+
 /* Definition of LIMESDR_TX_AMPL limits maximum amplitude of I and Q
 * channels separately. Hence LIMESDR_TX_AMPL value must be 1/sqrt(2) =
 * 0.7071.... to get an amplitude of 1 of the complex signal:
@@ -48,8 +54,52 @@ enum lms_dev_type {
 	LMS_DEV_UNKNOWN,
 };

+struct dev_band_desc {
+	/* Maximum LimeSuite Tx Gain which can be set/used without distorting
+	   the output * signal, and the resulting real output power measured
+	   when that gain is used.
+	 */
+	double nom_lms_tx_gain;  /* dB */
+	double nom_out_tx_power; /* dBm */
+	/* Factor used to infer base real RSSI offset on the Rx path based on current
+	   configured RxGain. The resulting rssiOffset is added to the per burst
+	   calculated energy in upper layers. These values were empirically
+	   found and may change based on multiple factors, see OS#4468.
+	   Correct measured values only provided for LimeSDR-USB so far.
+	   rssiOffset = rxGain + rxgain2rssioffset_rel;
+	*/
+	double rxgain2rssioffset_rel; /* dB */
+};
+
+/* Device parameter descriptor */
+struct dev_desc {
+	/* Does LimeSuite allow switching the clock source for this device?
+	 * LimeSDR-Mini does not have switches but needs soldering to select
+	 * external/internal clock. Any call to LMS_SetClockFreq() will fail.
+	 */
+	bool clock_src_switchable;
+	/* Does LimeSuite allow using REF_INTERNAL for this device?
+	 * LimeNET-Micro does not like selecting internal clock
+	 */
+	bool clock_src_int_usable;
+	/* Sample rate coef (without having TX/RX samples per symbol into account) */
+	double rate;
+	/* Sample rate coef (without having TX/RX samples per symbol into account), if multi-arfcn is enabled */
+	double rate_multiarfcn;
+	/* Coefficient multiplied by TX sample rate in order to shift Tx time */
+	double ts_offset_coef;
+	/* Coefficient multiplied by TX sample rate in order to shift Tx time, if multi-arfcn is enabled */
+	double ts_offset_coef_multiarfcn;
+	/* Device Name Prefix as presented by LimeSuite API LMS_GetDeviceInfo() */
+	std::string desc_str;
+};
+
+using dev_band_key_t = std::tuple<lms_dev_type, gsm_band>;
+using power_map_t = std::map<dev_band_key_t, dev_band_desc>;
+using dev_map_t = std::map<lms_dev_type, struct dev_desc>;
+
 /** A class to handle a LimeSuite supported device */
-class LMSDevice:public RadioDevice {
+class LMSDevice:public RadioDevice, public band_manager<power_map_t, dev_map_t> {

 private:
 	lms_device_t *m_lms_dev;
@@ -77,27 +127,25 @@ private:
 	void update_stream_stats_rx(size_t chan, bool *overrun);
 	void update_stream_stats_tx(size_t chan, bool *underrun);
 	bool do_clock_src_freq(enum ReferenceType ref, double freq);
-
 public:

 	/** Object constructor */
-	LMSDevice(size_t tx_sps, size_t rx_sps, InterfaceType iface, size_t chan_num, double lo_offset,
-		  const std::vector<std::string>& tx_paths,
-		  const std::vector<std::string>& rx_paths);
-	~LMSDevice();
+    LMSDevice(InterfaceType iface, const struct trx_cfg *cfg);
+    ~LMSDevice();

-	/** Instantiate the LMS */
-	int open(const std::string &args, int ref, bool swap_channels);
+    /** Instantiate the LMS */
+    int open();

-	/** Start the LMS */
-	bool start();
+    /** Start the LMS */
+    bool start();

-	/** Stop the LMS */
-	bool stop();
+    /** Stop the LMS */
+    bool stop();

-	enum TxWindowType getWindowType() {
-		return TX_WINDOW_LMS1;
-	}
+    enum TxWindowType getWindowType()
+    {
+	    return TX_WINDOW_LMS1;
+    }

 	/**
 	Read samples from the LMS.
@@ -165,19 +213,12 @@ public:
 	/** return minimum Rx Gain **/
 	double minRxGain(void);

-	/** sets the transmit chan gain, returns the gain setting **/
-	double setTxGain(double dB, size_t chan = 0);
+	double rssiOffset(size_t chan);

-	/** get transmit gain */
-	double getTxGain(size_t chan = 0) {
-		return tx_gains[chan];
-	}
+	double setPowerAttenuation(int atten, size_t chan);
+	double getPowerAttenuation(size_t chan = 0);

-	/** return maximum Tx Gain **/
-	double maxTxGain(void);
-
-	/** return minimum Rx Gain **/
-	double minTxGain(void);
+	int getNominalTxPower(size_t chan = 0);

 	/** sets the RX path to use, returns true if successful and false otherwise */
 	bool setRxAntenna(const std::string & ant, size_t chan = 0);
--- a/Transceiver52M/device/lms/Makefile.am
+++ b/Transceiver52M/device/lms/Makefile.am
@@ -1,7 +1,7 @@
 include $(top_srcdir)/Makefile.common

 AM_CPPFLAGS = -Wall $(STD_DEFINES_AND_INCLUDES) -I${srcdir}/../common
-AM_CXXFLAGS = -lpthread $(LIBOSMOCORE_CFLAGS) $(LIBOSMOCTRL_CFLAGS) $(LIBOSMOVTY_CFLAGS) $(LMS_CFLAGS)
+AM_CXXFLAGS = -lpthread $(LIBOSMOCORE_CFLAGS) $(LMS_CFLAGS)

 noinst_HEADERS = LMSDevice.h

--- a/Transceiver52M/device/uhd/Makefile.am
+++ b/Transceiver52M/device/uhd/Makefile.am
@@ -1,7 +1,7 @@
 include $(top_srcdir)/Makefile.common

 AM_CPPFLAGS = -Wall $(STD_DEFINES_AND_INCLUDES) -I${srcdir}/../common
-AM_CXXFLAGS = -lpthread $(LIBOSMOCORE_CFLAGS) $(LIBOSMOCTRL_CFLAGS) $(LIBOSMOVTY_CFLAGS) $(UHD_CFLAGS)
+AM_CXXFLAGS = -lpthread $(LIBOSMOCORE_CFLAGS) $(LIBOSMOVTY_CFLAGS) $(UHD_CFLAGS)

 noinst_HEADERS = UHDDevice.h

--- a/Transceiver52M/device/uhd/UHDDevice.cpp
+++ b/Transceiver52M/device/uhd/UHDDevice.cpp
@@ -33,6 +33,12 @@
 #include "config.h"
 #endif

+extern "C" {
+#include <osmocom/core/utils.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/vty/cpu_sched_vty.h>
+}
+
 #ifdef USE_UHD_3_11
 #include <uhd/utils/log_add.hpp>
 #include <uhd/utils/thread.hpp>
@@ -85,19 +91,7 @@
 *   USRP1 with timestamps is not supported by UHD.
 */

-/* Device Type, Tx-SPS, Rx-SPS */
-typedef std::tuple<uhd_dev_type, int, int> dev_key;
-
-/* Device parameter descriptor */
-struct dev_desc {
-	unsigned channels;
-	double mcr;
-	double rate;
-	double offset;
-	std::string str;
-};
-
-static const std::map<dev_key, dev_desc> dev_param_map {
+static const dev_map_t dev_param_map {
 	{ std::make_tuple(USRP2, 1, 1), { 1, 0.0,  390625,  1.2184e-4,  "N2XX 1 SPS"         } },
 	{ std::make_tuple(USRP2, 4, 1), { 1, 0.0,  390625,  7.6547e-5,  "N2XX 4/1 Tx/Rx SPS" } },
 	{ std::make_tuple(USRP2, 4, 4), { 1, 0.0,  390625,  4.6080e-5,  "N2XX 4 SPS"         } },
@@ -123,9 +117,21 @@ static const std::map<dev_key, dev_desc> dev_param_map {
 	{ std::make_tuple(B2XX_MCBTS, 4, 4), { 1, 51.2e6, MCBTS_SPACING*4, B2XX_TIMING_MCBTS, "B200/B210 4 SPS Multi-ARFCN" } },
 };

+static const power_map_t dev_band_nom_power_param_map {
+	{ std::make_tuple(B200, GSM_BAND_850),	{ 89.75, 13.3, -7.5  } },
+	{ std::make_tuple(B200, GSM_BAND_900),	{ 89.75, 13.3, -7.5  } },
+	{ std::make_tuple(B200, GSM_BAND_1800),	{ 89.75, 7.5,  -11.0 } },
+	{ std::make_tuple(B200, GSM_BAND_1900),	{ 89.75, 7.7,  -11.0 } },
+	{ std::make_tuple(B210, GSM_BAND_850),	{ 89.75, 13.3, -7.5  } },
+	{ std::make_tuple(B210, GSM_BAND_900),	{ 89.75, 13.3, -7.5  } },
+	{ std::make_tuple(B210, GSM_BAND_1800),	{ 89.75, 7.5,  -11.0 } },
+	{ std::make_tuple(B210, GSM_BAND_1900),	{ 89.75, 7.7,  -11.0 } },
+};
+
 void *async_event_loop(uhd_device *dev)
 {
 	set_selfthread_name("UHDAsyncEvent");
+	osmo_cpu_sched_vty_apply_localthread();

 	while (1) {
 		dev->recv_async_msg();
@@ -188,16 +194,22 @@ static void uhd_msg_handler(uhd::msg::type_t type, const std::string &msg)
 }
 #endif

-uhd_device::uhd_device(size_t tx_sps, size_t rx_sps,
-		       InterfaceType iface, size_t chan_num, double lo_offset,
-		       const std::vector<std::string>& tx_paths,
-		       const std::vector<std::string>& rx_paths)
-	: RadioDevice(tx_sps, rx_sps, iface, chan_num, lo_offset, tx_paths, rx_paths),
-	  tx_gain_min(0.0), tx_gain_max(0.0),
-	  rx_gain_min(0.0), rx_gain_max(0.0),
-	  tx_spp(0), rx_spp(0),
-	  started(false), aligned(false), drop_cnt(0),
-	  prev_ts(0,0), ts_initial(0), ts_offset(0), async_event_thrd(NULL)
+/* So far measurements done for B210 show really close to linear relationship
+ * between gain and real output power, so we simply adjust the measured offset
+ */
+static double TxGain2TxPower(const dev_band_desc &desc, double tx_gain_db)
+{
+	return desc.nom_out_tx_power - (desc.nom_uhd_tx_gain - tx_gain_db);
+}
+static double TxPower2TxGain(const dev_band_desc &desc, double tx_power_dbm)
+{
+	return desc.nom_uhd_tx_gain - (desc.nom_out_tx_power - tx_power_dbm);
+}
+
+uhd_device::uhd_device(InterfaceType iface, const struct trx_cfg *cfg)
+	: RadioDevice(iface, cfg), band_manager(dev_band_nom_power_param_map, dev_param_map), rx_gain_min(0.0),
+	  rx_gain_max(0.0), tx_spp(0), rx_spp(0), started(false), aligned(false), drop_cnt(0), prev_ts(0, 0),
+	  ts_initial(0), ts_offset(0), async_event_thrd(NULL)
 {
 }

@@ -211,6 +223,7 @@ uhd_device::~uhd_device()

 void uhd_device::init_gains()
 {
+	double tx_gain_min, tx_gain_max;
 	uhd::gain_range_t range;

 	if (dev_type == UMTRX) {
@@ -272,16 +285,68 @@ void uhd_device::set_rates()
 	rx_rate = usrp_dev->get_rx_rate();

 	ts_offset = static_cast<TIMESTAMP>(desc.offset * rx_rate);
-	LOGC(DDEV, INFO) << "Rates configured for " << desc.str;
+	LOGC(DDEV, INFO) << "Rates configured for " << desc.desc_str;
 }

-double uhd_device::setTxGain(double db, size_t chan)
+double uhd_device::setRxGain(double db, size_t chan)
 {
+	if (chan >= rx_gains.size()) {
+		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
+		return 0.0f;
+	}
+
+	if (cfg->overrides.ul_gain_override)
+		return rx_gains[chan];
+
+	usrp_dev->set_rx_gain(db, chan);
+	rx_gains[chan] = usrp_dev->get_rx_gain(chan);
+
+	LOGC(DDEV, INFO) << "Set RX gain to " << rx_gains[chan] << "dB (asked for " << db << "dB)";
+
+	return rx_gains[chan];
+}
+
+double uhd_device::getRxGain(size_t chan)
+{
+	if (chan >= rx_gains.size()) {
+		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
+		return 0.0f;
+	}
+
+	return rx_gains[chan];
+}
+
+double uhd_device::rssiOffset(size_t chan)
+{
+	double rssiOffset;
+	dev_band_desc desc;
+
+	if (chan >= rx_gains.size()) {
+		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
+		return 0.0f;
+	}
+
+	get_dev_band_desc(desc);
+	rssiOffset = rx_gains[chan] + desc.rxgain2rssioffset_rel;
+	return rssiOffset;
+}
+
+double uhd_device::setPowerAttenuation(int atten, size_t chan) {
+	double tx_power, db;
+	dev_band_desc desc;
+
 	if (chan >= tx_gains.size()) {
 		LOGC(DDEV, ALERT) << "Requested non-existent channel" << chan;
 		return 0.0f;
 	}

+	if (cfg->overrides.dl_gain_override)
+		return atten; // ensures caller does not apply digital attenuation
+
+	get_dev_band_desc(desc);
+	tx_power = desc.nom_out_tx_power - atten;
+	db = TxPower2TxGain(desc, tx_power);
+
 	if (dev_type == UMTRX) {
 		std::vector<std::string> gain_stages = usrp_dev->get_tx_gain_names(0);
 		if (gain_stages[0] == "VGA" || gain_stages[0] == "PA") {
@@ -301,44 +366,29 @@ double uhd_device::setTxGain(double db, size_t chan)

 	tx_gains[chan] = usrp_dev->get_tx_gain(chan);

-	LOGC(DDEV, INFO) << "Set TX gain to " << tx_gains[chan] << "dB (asked for " << db << "dB)";
+	LOGC(DDEV, INFO) << "Set TX gain to " << tx_gains[chan] << "dB, ~"
+			 <<  TxGain2TxPower(desc, tx_gains[chan]) << " dBm "
+			 << "(asked for " << db << " dB, ~" << tx_power << " dBm)";

-	return tx_gains[chan];
+	return desc.nom_out_tx_power - TxGain2TxPower(desc, tx_gains[chan]);
 }
-
-double uhd_device::setRxGain(double db, size_t chan)
-{
-	if (chan >= rx_gains.size()) {
-		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
-		return 0.0f;
-	}
-
-	usrp_dev->set_rx_gain(db, chan);
-	rx_gains[chan] = usrp_dev->get_rx_gain(chan);
-
-	LOGC(DDEV, INFO) << "Set RX gain to " << rx_gains[chan] << "dB (asked for " << db << "dB)";
-
-	return rx_gains[chan];
-}
-
-double uhd_device::getRxGain(size_t chan)
-{
-	if (chan >= rx_gains.size()) {
-		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
-		return 0.0f;
-	}
-
-	return rx_gains[chan];
-}
-
-double uhd_device::getTxGain(size_t chan)
-{
+double uhd_device::getPowerAttenuation(size_t chan) {
+	dev_band_desc desc;
 	if (chan >= tx_gains.size()) {
 		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
 		return 0.0f;
 	}

-	return tx_gains[chan];
+	get_dev_band_desc(desc);
+	return desc.nom_out_tx_power - TxGain2TxPower(desc, tx_gains[chan]);
+}
+
+int uhd_device::getNominalTxPower(size_t chan)
+{
+	dev_band_desc desc;
+	get_dev_band_desc(desc);
+
+	return desc.nom_out_tx_power;
 }

 /*
@@ -444,9 +494,10 @@ void uhd_device::set_channels(bool swap)
 	}
 }

-int uhd_device::open(const std::string &args, int ref, bool swap_channels)
+int uhd_device::open()
 {
 	const char *refstr;
+	int clock_lock_attempts = 15;

 	/* Register msg handler. Different APIs depending on UHD version */
 #ifdef USE_UHD_3_11
@@ -459,10 +510,10 @@ int uhd_device::open(const std::string &args, int ref, bool swap_channels)
 #endif

 	// Find UHD devices
-	uhd::device_addr_t addr(args);
+	uhd::device_addr_t addr(cfg->dev_args);
 	uhd::device_addrs_t dev_addrs = uhd::device::find(addr);
 	if (dev_addrs.size() == 0) {
-		LOGC(DDEV, ALERT) << "No UHD devices found with address '" << args << "'";
+		LOGC(DDEV, ALERT) << "No UHD devices found with address '" << cfg->dev_args << "'";
 		return -1;
 	}

@@ -471,7 +522,7 @@ int uhd_device::open(const std::string &args, int ref, bool swap_channels)
 	try {
 		usrp_dev = uhd::usrp::multi_usrp::make(addr);
 	} catch(uhd::key_error::exception &e) {
-		LOGC(DDEV, ALERT) << "UHD make failed, device " << args << ", exception:\n" << e.what();
+		LOGC(DDEV, ALERT) << "UHD make failed, device " << cfg->dev_args << ", exception:\n" << e.what();
 		return -1;
 	}

@@ -479,14 +530,16 @@ int uhd_device::open(const std::string &args, int ref, bool swap_channels)
 	if (!parse_dev_type())
 		return -1;

+	update_band_dev(dev_key(dev_type, tx_sps, rx_sps));
+
 	if ((dev_type == E3XX) && !uhd_e3xx_version_chk()) {
 		LOGC(DDEV, ALERT) << "E3XX requires UHD 003.009.000 or greater";
 		return -1;
 	}

 	try {
-		set_channels(swap_channels);
-        } catch (const std::exception &e) {
+		set_channels(cfg->swap_channels);
+	} catch (const std::exception &e) {
 		LOGC(DDEV, ALERT) << "Channel setting failed - " << e.what();
 		return -1;
 	}
@@ -502,7 +555,7 @@ int uhd_device::open(const std::string &args, int ref, bool swap_channels)
 	rx_gains.resize(chans);
 	rx_buffers.resize(chans);

-	switch (ref) {
+	switch (cfg->clock_ref) {
 	case REF_INTERNAL:
 		refstr = "internal";
 		break;
@@ -519,6 +572,19 @@ int uhd_device::open(const std::string &args, int ref, bool swap_channels)

 	usrp_dev->set_clock_source(refstr);

+	std::vector<std::string> sensor_names = usrp_dev->get_mboard_sensor_names();
+	if (std::find(sensor_names.begin(), sensor_names.end(), "ref_locked") != sensor_names.end()) {
+		LOGC(DDEV, INFO) << "Waiting for clock reference lock (max " << clock_lock_attempts << "s)..." << std::flush;
+		while (!usrp_dev->get_mboard_sensor("ref_locked", 0).to_bool() && clock_lock_attempts--)
+			sleep(1);
+
+		if (!clock_lock_attempts) {
+			LOGC(DDEV, ALERT) << "Locking to external 10Mhz failed!";
+			return -1;
+		}
+	}
+	LOGC(DDEV, INFO) << "Selected clock source is " << usrp_dev->get_clock_source(0);
+
 	try {
 		set_rates();
        } catch (const std::exception &e) {
@@ -568,6 +634,32 @@ int uhd_device::open(const std::string &args, int ref, bool swap_channels)
 	// Print configuration
 	LOGC(DDEV, INFO) << "Device configuration: " << usrp_dev->get_pp_string();

+	if (cfg->overrides.dl_freq_override) {
+		uhd::tune_request_t treq_tx = uhd::tune_request_t(cfg->overrides.dl_freq, 0);
+		auto tres = usrp_dev->set_tx_freq(treq_tx, 0);
+		tx_freqs[0] = usrp_dev->get_tx_freq(0);
+		LOGCHAN(0, DDEV, INFO) << "OVERRIDE set_freq(" << tx_freqs[0] << ", TX): " << tres.to_pp_string() << std::endl;
+	}
+
+	if (cfg->overrides.ul_freq_override) {
+		uhd::tune_request_t treq_rx = uhd::tune_request_t(cfg->overrides.ul_freq, 0);
+		auto tres = usrp_dev->set_rx_freq(treq_rx, 0);
+		rx_freqs[0] = usrp_dev->get_rx_freq(0);
+		LOGCHAN(0, DDEV, INFO) << "OVERRIDE set_freq(" << rx_freqs[0] << ", RX): " << tres.to_pp_string() << std::endl;
+	}
+
+	if (cfg->overrides.ul_gain_override) {
+		usrp_dev->set_rx_gain(cfg->overrides.ul_gain, 0);
+		rx_gains[0] = usrp_dev->get_rx_gain(0);
+		LOGCHAN(0, DDEV, INFO) << " OVERRIDE RX gain:" << rx_gains[0] << std::endl;
+	}
+
+	if (cfg->overrides.dl_gain_override) {
+		usrp_dev->set_tx_gain(cfg->overrides.dl_gain, 0);
+		tx_gains[0] = usrp_dev->get_tx_gain(0);
+		LOGCHAN(0, DDEV, INFO) << " OVERRIDE TX gain:" << tx_gains[0] << std::endl;
+	}
+
 	if (iface == MULTI_ARFCN)
 		return MULTI_ARFCN;

@@ -674,6 +766,12 @@ bool uhd_device::stop()
 	async_event_thrd->join();
 	delete async_event_thrd;

+	/* reset internal buffer timestamps */
+	for (size_t i = 0; i < rx_buffers.size(); i++)
+		rx_buffers[i]->reset();
+
+	band_reset();
+
 	started = false;
 	return true;
 }
@@ -912,17 +1010,22 @@ bool uhd_device::set_freq(double freq, size_t chan, bool tx)
 {
 	std::vector<double> freqs;
 	uhd::tune_result_t tres;
+	std::string str_dir = tx ? "Tx" : "Rx";
+
+	if (cfg->overrides.dl_freq_override || cfg->overrides.ul_freq_override)
+		return true;
+
+	if (!update_band_from_freq(freq, chan, tx))
+		return false;
+
 	uhd::tune_request_t treq = select_freq(freq, chan, tx);
-	std::string str_dir;

 	if (tx) {
 		tres = usrp_dev->set_tx_freq(treq, chan);
 		tx_freqs[chan] = usrp_dev->get_tx_freq(chan);
-		str_dir = "Tx";
 	} else {
 		tres = usrp_dev->set_rx_freq(treq, chan);
 		rx_freqs[chan] = usrp_dev->get_rx_freq(chan);
-		str_dir = "Rx";
 	}
 	LOGCHAN(chan, DDEV, INFO) << "set_freq(" << freq << ", " << str_dir << "): " << tres.to_pp_string() << std::endl;

@@ -956,7 +1059,6 @@ bool uhd_device::setTxFreq(double wFreq, size_t chan)
 		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
 		return false;
 	}
-	ScopedLock lock(tune_lock);

 	return set_freq(wFreq, chan, true);
 }
@@ -967,7 +1069,6 @@ bool uhd_device::setRxFreq(double wFreq, size_t chan)
 		LOGC(DDEV, ALERT) << "Requested non-existent channel " << chan;
 		return false;
 	}
-	ScopedLock lock(tune_lock);

 	return set_freq(wFreq, chan, false);
 }
@@ -1000,7 +1101,14 @@ bool uhd_device::setRxAntenna(const std::string &ant, size_t chan)
 		return false;
 	}

-	avail = usrp_dev->get_rx_antennas(chan);
+	/* UHD may throw a LookupError/IndexError here (see OS#4636) */
+	try {
+		avail = usrp_dev->get_rx_antennas(chan);
+	} catch (const uhd::index_error &e) {
+		LOGC(DDEV, ALERT) << "UHD Error: " << e.what();
+		return false;
+	}
+
 	if (std::find(avail.begin(), avail.end(), ant) == avail.end()) {
 		LOGC(DDEV, ALERT) << "Requested non-existent Rx antenna " << ant << " on channel " << chan;
 		LOGC(DDEV, INFO) << "Available Rx antennas: ";
@@ -1036,7 +1144,14 @@ bool uhd_device::setTxAntenna(const std::string &ant, size_t chan)
 		return false;
 	}

-	avail = usrp_dev->get_tx_antennas(chan);
+	/* UHD may throw a LookupError/IndexError here (see OS#4636) */
+	try {
+		avail = usrp_dev->get_tx_antennas(chan);
+	} catch (const uhd::index_error &e) {
+		LOGC(DDEV, ALERT) << "UHD Error: " << e.what();
+		return false;
+	}
+
 	if (std::find(avail.begin(), avail.end(), ant) == avail.end()) {
 		LOGC(DDEV, ALERT) << "Requested non-existent Tx antenna " << ant << " on channel " << chan;
 		LOGC(DDEV, INFO) << "Available Tx antennas: ";
@@ -1202,10 +1317,9 @@ std::string uhd_device::str_code(uhd::async_metadata_t metadata)
 	return ost.str();
 }

-RadioDevice *RadioDevice::make(size_t tx_sps, size_t rx_sps,
-			       InterfaceType iface, size_t chans, double lo_offset,
-			       const std::vector<std::string>& tx_paths,
-			       const std::vector<std::string>& rx_paths)
+#ifndef IPCMAGIC
+RadioDevice *RadioDevice::make(InterfaceType type, const struct trx_cfg *cfg)
 {
-	return new uhd_device(tx_sps, rx_sps, iface, chans, lo_offset, tx_paths, rx_paths);
+	return new uhd_device(type, cfg);
 }
+#endif
--- a/Transceiver52M/device/uhd/UHDDevice.h
+++ b/Transceiver52M/device/uhd/UHDDevice.h
@@ -30,6 +30,7 @@
 #include "config.h"
 #endif

+#include "bandmanager.h"
 #include "radioDevice.h"
 #include "smpl_buf.h"

@@ -37,6 +38,10 @@
 #include <uhd/property_tree.hpp>
 #include <uhd/usrp/multi_usrp.hpp>

+extern "C" {
+#include <osmocom/gsm/gsm_utils.h>
+}
+

 enum uhd_dev_type {
 	USRP1,
@@ -52,6 +57,34 @@ enum uhd_dev_type {
 	LIMESDR,
 };

+struct dev_band_desc {
+	/* Maximum UHD Tx Gain which can be set/used without distorting the
+	   output signal, and the resulting real output power measured when that
+	   gain is used. Correct measured values only provided for B210 so far. */
+	double nom_uhd_tx_gain;  /* dB */
+	double nom_out_tx_power; /* dBm */
+	/* Factor used to infer base real RSSI offset on the Rx path based on current
+	   configured RxGain. The resulting rssiOffset is added to the per burst
+	   calculated energy in upper layers. These values were empirically
+	   found and may change based on multiple factors, see OS#4468.
+	   rssiOffset = rxGain + rxgain2rssioffset_rel;
+	*/
+	double rxgain2rssioffset_rel; /* dB */
+};
+
+struct dev_desc {
+	unsigned channels;
+	double mcr;
+	double rate;
+	double offset;
+	std::string desc_str;
+};
+
+using dev_key = std::tuple<uhd_dev_type, int, int>;
+using dev_band_key = std::tuple<uhd_dev_type, enum gsm_band>;
+using power_map_t = std::map<dev_band_key, dev_band_desc>;
+using dev_map_t = std::map<dev_key, dev_desc>;
+
 /*
    uhd_device - UHD implementation of the Device interface. Timestamped samples
                are sent to and received from the device. An intermediate buffer
@@ -59,19 +92,19 @@ enum uhd_dev_type {
                Events and errors such as underruns are reported asynchronously
                by the device and received in a separate thread.
 */
-class uhd_device : public RadioDevice {
+class uhd_device : public RadioDevice, public band_manager<power_map_t, dev_map_t> {
 public:
-	uhd_device(size_t tx_sps, size_t rx_sps, InterfaceType type,
-		   size_t chan_num, double offset,
-		   const std::vector<std::string>& tx_paths,
-		   const std::vector<std::string>& rx_paths);
-	~uhd_device();
+    uhd_device(InterfaceType iface, const struct trx_cfg *cfg);
+    ~uhd_device();

-	int open(const std::string &args, int ref, bool swap_channels);
-	bool start();
-	bool stop();
-	bool restart();
-	enum TxWindowType getWindowType() { return tx_window; }
+    int open();
+    bool start();
+    bool stop();
+    bool restart();
+    enum TxWindowType getWindowType()
+    {
+	    return tx_window;
+    }

 	int readSamples(std::vector<short *> &bufs, int len, bool *overrun,
 			TIMESTAMP timestamp, bool *underrun);
@@ -94,11 +127,12 @@ public:
 	double getRxGain(size_t chan);
 	double maxRxGain(void) { return rx_gain_max; }
 	double minRxGain(void) { return rx_gain_min; }
+	double rssiOffset(size_t chan);

-	double setTxGain(double db, size_t chan);
-	double getTxGain(size_t chan = 0);
-	double maxTxGain(void) { return tx_gain_max; }
-	double minTxGain(void) { return tx_gain_min; }
+	double setPowerAttenuation(int atten, size_t chan);
+	double getPowerAttenuation(size_t chan = 0);
+
+	int getNominalTxPower(size_t chan = 0);

 	double getTxFreq(size_t chan);
 	double getRxFreq(size_t chan);
@@ -127,7 +161,7 @@ public:
 		ERROR_UNHANDLED = -4,
 	};

-private:
+protected:
 	uhd::usrp::multi_usrp::sptr usrp_dev;
 	uhd::tx_streamer::sptr tx_stream;
 	uhd::rx_streamer::sptr rx_stream;
@@ -136,7 +170,6 @@ private:

 	double tx_rate, rx_rate;

-	double tx_gain_min, tx_gain_max;
 	double rx_gain_min, rx_gain_max;

 	std::vector<double> tx_gains, rx_gains;
@@ -171,5 +204,4 @@ private:
 	bool set_freq(double freq, size_t chan, bool tx);

 	Thread *async_event_thrd;
-	Mutex tune_lock;
 };
--- a/Transceiver52M/device/usrp1/Makefile.am
+++ b/Transceiver52M/device/usrp1/Makefile.am
@@ -1,7 +1,7 @@
 include $(top_srcdir)/Makefile.common

 AM_CPPFLAGS = -Wall $(STD_DEFINES_AND_INCLUDES) -I${srcdir}/../common
-AM_CXXFLAGS = -lpthread $(LIBOSMOCORE_CFLAGS) $(LIBOSMOCTRL_CFLAGS) $(LIBOSMOVTY_CFLAGS) $(USRP_CFLAGS)
+AM_CXXFLAGS = -lpthread $(LIBOSMOCORE_CFLAGS) $(USRP_CFLAGS)

 rev2dir = $(datadir)/usrp/rev2
 rev4dir = $(datadir)/usrp/rev4
--- a/Transceiver52M/device/usrp1/USRPDevice.cpp
+++ b/Transceiver52M/device/usrp1/USRPDevice.cpp
@@ -60,11 +60,7 @@ const dboardConfigType dboardConfig = TXA_RXB;

 const double USRPDevice::masterClockRate = 52.0e6;

-USRPDevice::USRPDevice(size_t tx_sps, size_t rx_sps, InterfaceType iface,
-		       size_t chan_num, double lo_offset,
-		       const std::vector<std::string>& tx_paths,
-		       const std::vector<std::string>& rx_paths):
-		RadioDevice(tx_sps, rx_sps, iface, chan_num, lo_offset, tx_paths, rx_paths)
+USRPDevice::USRPDevice(InterfaceType iface, const struct trx_cfg *cfg) : RadioDevice(iface, cfg)
 {
  LOGC(DDEV, INFO) << "creating USRP device...";

@@ -94,7 +90,7 @@ USRPDevice::USRPDevice(size_t tx_sps, size_t rx_sps, InterfaceType iface,
 #endif
 }

-int USRPDevice::open(const std::string &, int, bool)
+int USRPDevice::open()
 {
  writeLock.unlock();

@@ -205,8 +201,8 @@ bool USRPDevice::start()
  writeLock.unlock();

  // Set gains to midpoint
-  setTxGain((minTxGain() + maxTxGain()) / 2);
-  setRxGain((minRxGain() + maxRxGain()) / 2);
+  setTxGain((m_dbTx->gain_min() + m_dbTx->gain_max()) / 2);
+  setRxGain((m_dbTx->gain_min() + m_dbTx->gain_max()) / 2);

  data = new short[currDataSize];
  dataStart = 0;
@@ -243,16 +239,6 @@ bool USRPDevice::stop()
 #endif
 }

-double USRPDevice::maxTxGain()
-{
-  return m_dbTx->gain_max();
-}
-
-double USRPDevice::minTxGain()
-{
-  return m_dbTx->gain_min();
-}
-
 double USRPDevice::maxRxGain()
 {
  return m_dbRx->gain_max();
@@ -271,10 +257,10 @@ double USRPDevice::setTxGain(double dB, size_t chan)
  }

  writeLock.lock();
-  if (dB > maxTxGain())
-    dB = maxTxGain();
-  if (dB < minTxGain())
-    dB = minTxGain();
+  if (dB > m_dbTx->gain_max())
+    dB = m_dbTx->gain_max();
+  if (dB < m_dbTx->gain_min())
+    dB = m_dbTx->gain_min();

  LOGC(DDEV, NOTICE) << "Setting TX gain to " << dB << " dB.";

@@ -314,6 +300,23 @@ double USRPDevice::setRxGain(double dB, size_t chan)
  return rxGain;
 }

+double USRPDevice::setPowerAttenuation(int atten, size_t chan) {
+      double rfGain;
+      rfGain = setTxGain(m_dbTx->gain_max() - atten, chan);
+      return m_dbTx->gain_max() - rfGain;
+}
+double USRPDevice::getPowerAttenuation(size_t chan) {
+      return m_dbTx->gain_max() - getTxGain(chan);
+}
+
+int USRPDevice::getNominalTxPower(size_t chan)
+{
+	/* TODO: return value based on some experimentally generated table depending on
+	 * band/arfcn, which is known here thanks to TXTUNE
+	 */
+	return 23;
+}
+
 bool USRPDevice::setRxAntenna(const std::string &ant, size_t chan)
 {
 	if (chan >= rx_paths.size()) {
@@ -580,8 +583,7 @@ bool USRPDevice::updateAlignment(TIMESTAMP timestamp)
 {
 #ifndef SWLOOPBACK
  short data[] = {0x00,0x02,0x00,0x00};
-  uint32_t *wordPtr = (uint32_t *) data;
-  *wordPtr = host_to_usrp_u32(*wordPtr);
+  /* FIXME: big endian */
  bool tmpUnderrun;

  std::vector<short *> buf(1, data);
@@ -652,22 +654,19 @@ bool USRPDevice::setTxFreq(double wFreq) { return true;};
 bool USRPDevice::setRxFreq(double wFreq) { return true;};
 #endif

-RadioDevice *RadioDevice::make(size_t tx_sps, size_t rx_sps,
-			       InterfaceType iface, size_t chans, double lo_offset,
-			       const std::vector<std::string>& tx_paths,
-			       const std::vector<std::string>& rx_paths)
+RadioDevice *RadioDevice::make(InterfaceType type, const struct trx_cfg *cfg)
 {
-	if (tx_sps != rx_sps) {
-		LOGC(DDEV, ERROR) << "USRP1 requires tx_sps == rx_sps";
-		return NULL;
-	}
-	if (chans != 1) {
-		LOGC(DDEV, ERROR) << "USRP1 supports only 1 channel";
-		return NULL;
-	}
-	if (lo_offset != 0.0) {
-		LOGC(DDEV, ERROR) << "USRP1 doesn't support lo_offset";
-		return NULL;
-	}
-	return new USRPDevice(tx_sps, rx_sps, iface, chans, lo_offset, tx_paths, rx_paths);
+  if (cfg->tx_sps != cfg->rx_sps) {
+    LOGC(DDEV, ERROR) << "USRP1 requires tx_sps == rx_sps";
+    return NULL;
+  }
+  if (cfg->num_chans != 1) {
+    LOGC(DDEV, ERROR) << "USRP1 supports only 1 channel";
+    return NULL;
+  }
+  if (cfg->offset != 0.0) {
+    LOGC(DDEV, ERROR) << "USRP1 doesn't support lo_offset";
+    return NULL;
+  }
+  return new USRPDevice(type, cfg);
 }
--- a/Transceiver52M/device/usrp1/USRPDevice.h
+++ b/Transceiver52M/device/usrp1/USRPDevice.h
@@ -85,6 +85,12 @@ private:
  int writeSamplesControl(std::vector<short *> &bufs, int len, bool *underrun,
                   TIMESTAMP timestamp = 0xffffffff, bool isControl = false);

+  /** sets the transmit chan gain, returns the gain setting **/
+  double setTxGain(double dB, size_t chan = 0);
+
+  /** get transmit gain */
+  double getTxGain(size_t chan = 0) { return txGain; }
+
 #ifdef SWLOOPBACK
  short loopbackBuffer[1000000];
  int loopbackBufferSize;
@@ -98,20 +104,21 @@ private:
 public:

  /** Object constructor */
-  USRPDevice(size_t tx_sps, size_t rx_sps, InterfaceType iface, size_t chan_num, double lo_offset,
-		const std::vector<std::string>& tx_paths,
-		const std::vector<std::string>& rx_paths);
+     USRPDevice(InterfaceType iface, const struct trx_cfg *cfg);

-  /** Instantiate the USRP */
-  int open(const std::string &, int, bool);
+     /** Instantiate the USRP */
+     int open();

-  /** Start the USRP */
-  bool start();
+     /** Start the USRP */
+     bool start();

-  /** Stop the USRP */
-  bool stop();
+     /** Stop the USRP */
+     bool stop();

-  enum TxWindowType getWindowType() { return TX_WINDOW_USRP1; }
+     enum TxWindowType getWindowType()
+     {
+	     return TX_WINDOW_USRP1;
+     }

  /**
 	Read samples from the USRP.
@@ -168,17 +175,12 @@ private:
  /** return minimum Rx Gain **/
  double minRxGain(void);

-  /** sets the transmit chan gain, returns the gain setting **/
-  double setTxGain(double dB, size_t chan = 0);
+  double rssiOffset(size_t chan) { return 0.0f;  } /* FIXME: not implemented */

-  /** get transmit gain */
-  double getTxGain(size_t chan = 0) { return txGain; }
+  double setPowerAttenuation(int atten, size_t chan);
+  double getPowerAttenuation(size_t chan=0);

-  /** return maximum Tx Gain **/
-  double maxTxGain(void);
-
-  /** return minimum Rx Gain **/
-  double minTxGain(void);
+  int getNominalTxPower(size_t chan = 0);

  /** sets the RX path to use, returns true if successful and false otherwise */
  bool setRxAntenna(const std::string &ant, size_t chan = 0);
--- a/Transceiver52M/grgsm_vitac/constants.h
+++ b/Transceiver52M/grgsm_vitac/constants.h
@@ -0,0 +1,149 @@
+#pragma once
+/* -*- c++ -*- */
+/*
+ * @file
+ * @author (C) 2009-2017  by Piotr Krysik <ptrkrysik@gmail.com>
+ * @section LICENSE
+ *
+ * Gr-gsm is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3, or (at your option)
+ * any later version.
+ *
+ * Gr-gsm is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with gr-gsm; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include <complex>
+
+#define gr_complex std::complex<float>
+
+
+#define GSM_SYMBOL_RATE  (1625000.0/6.0) //symbols per second
+#define GSM_SYMBOL_PERIOD (1.0/GSM_SYMBOL_RATE) //seconds per symbol
+
+//Burst timing
+#define TAIL_BITS         3
+#define GUARD_BITS        8
+#define GUARD_FRACTIONAL  0.25 //fractional part of guard period
+#define GUARD_PERIOD      GUARD_BITS + GUARD_FRACTIONAL
+#define DATA_BITS         57   //size of 1 data block in normal burst
+#define STEALING_BIT      1
+#define N_TRAIN_BITS      26
+#define N_SYNC_BITS       64
+#define N_ACCESS_BITS     41
+#define USEFUL_BITS       142  //(2*(DATA_BITS+STEALING_BIT) + N_TRAIN_BITS )
+#define FCCH_BITS         USEFUL_BITS
+#define BURST_SIZE        (USEFUL_BITS+2*TAIL_BITS)
+#define ACCESS_BURST_SIZE 88
+#define PROCESSED_CHUNK   BURST_SIZE+2*GUARD_PERIOD
+
+#define SCH_DATA_LEN      39
+#define TS_BITS           (TAIL_BITS+USEFUL_BITS+TAIL_BITS+GUARD_BITS)  //a full TS (156 bits)
+#define TS_PER_FRAME      8
+#define FRAME_BITS        (TS_PER_FRAME * TS_BITS + 2) // 156.25 * 8
+#define FCCH_POS          TAIL_BITS
+#define SYNC_POS          (TAIL_BITS + 39)
+#define TRAIN_POS         ( TAIL_BITS + (DATA_BITS+STEALING_BIT) + 5) //first 5 bits of a training sequence
+													   //aren't used for channel impulse response estimation
+#define TRAIN_BEGINNING   5
+#define SAFETY_MARGIN     6   //
+
+#define FCCH_HITS_NEEDED        (USEFUL_BITS - 4)
+#define FCCH_MAX_MISSES         1
+#define FCCH_MAX_FREQ_OFFSET    100
+
+#define CHAN_IMP_RESP_LENGTH  5
+
+#define MAX_SCH_ERRORS    10  //maximum number of subsequent sch errors after which gsm receiver goes to find_next_fcch state
+
+typedef enum { empty, fcch_burst, sch_burst, normal_burst, rach_burst, dummy, dummy_or_normal, normal_or_noise } burst_type;
+typedef enum { unknown, multiframe_26, multiframe_51 } multiframe_type;
+
+static const unsigned char SYNC_BITS[] = {
+  1, 0, 1, 1, 1, 0, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0,
+  0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1,
+  0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 1,
+  0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1
+};
+
+static const unsigned char ACCESS_BITS [] = {
+ 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1,
+ 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0,
+ 0, 1, 1, 1, 1, 0, 0, 0
+};
+
+const unsigned FCCH_FRAMES[] = { 0, 10, 20, 30, 40 };
+const unsigned SCH_FRAMES[] = { 1, 11, 21, 31, 41 };
+
+const unsigned BCCH_FRAMES[] = { 2, 3, 4, 5 };          //!!the receiver shouldn't care about logical
+													  //!!channels so this will be removed from this header
+const unsigned TEST_CCH_FRAMES[] = { 2, 3, 4, 5, 6, 7, 8, 9, 12, 13, 14, 15, 16, 17, 18, 19, 22, 23, 24, 25, 26, 27, 28, 29, 32, 33, 34, 35, 36, 37, 38, 39, 42, 43, 44, 45, 46, 47, 48, 49 };
+const unsigned TRAFFIC_CHANNEL_F[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24 };
+const unsigned TEST51[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50 };
+
+
+#define TSC0  0
+#define TSC1  1
+#define TSC2  2
+#define TSC3  3
+#define TSC4  4
+#define TSC5  5
+#define TSC6  6
+#define TSC7  7
+#define TS_DUMMY 8
+
+#define TRAIN_SEQ_NUM 9
+
+#define TIMESLOT0  0
+#define TIMESLOT1  1
+#define TIMESLOT2  2
+#define TIMESLOT3  3
+#define TIMESLOT4  4
+#define TIMESLOT5  5
+#define TIMESLOT6  6
+#define TIMESLOT7  7
+
+
+static const unsigned char train_seq[TRAIN_SEQ_NUM][N_TRAIN_BITS] = {
+  {0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 1},
+  {0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 1},
+  {0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0},
+  {0, 1, 0, 0, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0},
+  {0, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 1, 0, 1, 1},
+  {0, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 0},
+  {1, 0, 1, 0, 0, 1, 1, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 1, 1, 1, 1},
+  {1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0},
+  {0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1} // DUMMY
+};
+
+
+//Dummy burst 0xFB 76 0A 4E 09 10 1F 1C 5C 5C 57 4A 33 39 E9 F1 2F A8
+static const unsigned char dummy_burst[] = {
+  0, 0, 0,
+  1, 1, 1, 1, 1, 0, 1, 1, 0, 1,
+  1, 1, 0, 1, 1, 0, 0, 0, 0, 0,
+  1, 0, 1, 0, 0, 1, 0, 0, 1, 1,
+  1, 0, 0, 0, 0, 0, 1, 0, 0, 1,
+  0, 0, 0, 1, 0, 0, 0, 0, 0, 0,
+  0, 1, 1, 1, 1, 1, 0, 0,
+
+  0, 1, 1, 1, 0, 0, 0, 1, 0, 1,
+  1, 1, 0, 0, 0, 1, 0, 1, 1, 1,
+  0, 0, 0, 1, 0, 1,
+
+  0, 1, 1, 1, 0, 1, 0, 0, 1, 0,
+  1, 0, 0, 0, 1, 1, 0, 0, 1, 1,
+  0, 0, 1, 1, 1, 0, 0, 1, 1, 1,
+  1, 0, 1, 0, 0, 1, 1, 1, 1, 1,
+  0, 0, 0, 1, 0, 0, 1, 0, 1, 1,
+  1, 1, 1, 0, 1, 0, 1, 0,
+  0, 0, 0
+};
--- a/Transceiver52M/grgsm_vitac/grgsm_vitac.cpp
+++ b/Transceiver52M/grgsm_vitac/grgsm_vitac.cpp
@@ -0,0 +1,305 @@
+/* -*- c++ -*- */
+/*
+ * @file
+ * @author (C) 2009-2017  by Piotr Krysik <ptrkrysik@gmail.com>
+ * @author Contributions by sysmocom - s.f.m.c. GmbH / Eric Wild <ewild@sysmocom.de>
+ * @section LICENSE
+ *
+ * Gr-gsm is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3, or (at your option)
+ * any later version.
+ *
+ * Gr-gsm is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with gr-gsm; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "constants.h"
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+#include <complex>
+
+
+#include <algorithm>
+#include <string.h>
+#include <iostream>
+#include <numeric>
+#include <vector>
+#include <fstream>
+
+#include "viterbi_detector.h"
+#include "grgsm_vitac.h"
+
+gr_complex d_acc_training_seq[N_ACCESS_BITS]; ///<encoded training sequence of a RACH burst
+gr_complex d_sch_training_seq[N_SYNC_BITS]; ///<encoded training sequence of a SCH burst
+gr_complex d_norm_training_seq[TRAIN_SEQ_NUM][N_TRAIN_BITS]; ///<encoded training sequences of a normal and dummy burst
+const int d_chan_imp_length = CHAN_IMP_RESP_LENGTH;
+
+void initvita()
+{
+	/**
+	 * Prepare SCH sequence bits
+	 *
+	 * (TS_BITS + 2 * GUARD_PERIOD)
+	 * Burst and two guard periods
+	 * (one guard period is an arbitrary overlap)
+	 */
+	gmsk_mapper(SYNC_BITS, N_SYNC_BITS, d_sch_training_seq, gr_complex(0.0, -1.0));
+	for (auto &i : d_sch_training_seq)
+		i = conj(i);
+
+	/* ab */
+	gmsk_mapper(ACCESS_BITS, N_ACCESS_BITS, d_acc_training_seq, gr_complex(0.0, -1.0));
+	for (auto &i : d_acc_training_seq)
+		i = conj(i);
+
+	/* Prepare bits of training sequences */
+	for (int i = 0; i < TRAIN_SEQ_NUM; i++) {
+		/**
+		 * If first bit of the sequence is 0
+		 * => first symbol is 1, else -1
+		 */
+		gr_complex startpoint = train_seq[i][0] == 0 ? gr_complex(1.0, 0.0) : gr_complex(-1.0, 0.0);
+		gmsk_mapper(train_seq[i], N_TRAIN_BITS, d_norm_training_seq[i], startpoint);
+		for (auto &i : d_norm_training_seq[i])
+			i = conj(i);
+	}
+}
+
+template <unsigned int burst_size>
+NO_UBSAN static void detect_burst_generic(const gr_complex *input, gr_complex *chan_imp_resp, int burst_start,
+					  char *output_binary, int ss)
+{
+	std::vector<gr_complex> rhh_temp(CHAN_IMP_RESP_LENGTH * d_OSR);
+	unsigned int stop_states[2] = { 4, 12 };
+	gr_complex filtered_burst[burst_size];
+	gr_complex rhh[CHAN_IMP_RESP_LENGTH];
+	float output[burst_size];
+	int start_state = ss;
+
+	autocorrelation(chan_imp_resp, &rhh_temp[0], d_chan_imp_length * d_OSR);
+	for (int ii = 0; ii < d_chan_imp_length; ii++)
+		rhh[ii] = conj(rhh_temp[ii * d_OSR]);
+
+	mafi(&input[burst_start], burst_size, chan_imp_resp, d_chan_imp_length * d_OSR, filtered_burst);
+
+	viterbi_detector(filtered_burst, burst_size, rhh, start_state, stop_states, 2, output);
+
+	for (unsigned int i = 0; i < burst_size; i++)
+		output_binary[i] = output[i] > 0 ? -127 : 127; // pre flip bits!
+}
+
+NO_UBSAN void detect_burst_nb(const gr_complex *input, gr_complex *chan_imp_resp, int burst_start, char *output_binary,
+			      int ss)
+{
+	return detect_burst_generic<BURST_SIZE>(input, chan_imp_resp, burst_start, output_binary, ss);
+}
+NO_UBSAN void detect_burst_ab(const gr_complex *input, gr_complex *chan_imp_resp, int burst_start, char *output_binary,
+			      int ss)
+{
+	return detect_burst_generic<8 + 41 + 36 + 3>(input, chan_imp_resp, burst_start, output_binary, ss);
+}
+
+NO_UBSAN void detect_burst_nb(const gr_complex *input, gr_complex *chan_imp_resp, int burst_start, char *output_binary)
+{
+	return detect_burst_nb(input, chan_imp_resp, burst_start, output_binary, 3);
+}
+NO_UBSAN void detect_burst_ab(const gr_complex *input, gr_complex *chan_imp_resp, int burst_start, char *output_binary)
+{
+	return detect_burst_ab(input, chan_imp_resp, burst_start, output_binary, 3);
+}
+
+void gmsk_mapper(const unsigned char *input, int nitems, gr_complex *gmsk_output, gr_complex start_point)
+{
+	gr_complex j = gr_complex(0.0, 1.0);
+	gmsk_output[0] = start_point;
+
+	int previous_symbol = 2 * input[0] - 1;
+	int current_symbol;
+	int encoded_symbol;
+
+	for (int i = 1; i < nitems; i++) {
+		/* Change bits representation to NRZ */
+		current_symbol = 2 * input[i] - 1;
+
+		/* Differentially encode */
+		encoded_symbol = current_symbol * previous_symbol;
+
+		/* And do GMSK mapping */
+		gmsk_output[i] = j * gr_complex(encoded_symbol, 0.0) * gmsk_output[i - 1];
+
+		previous_symbol = current_symbol;
+	}
+}
+
+gr_complex correlate_sequence(const gr_complex *sequence, int length, const gr_complex *input)
+{
+	gr_complex result(0.0, 0.0);
+
+	for (int ii = 0; ii < length; ii++)
+		result += sequence[ii] * input[ii * d_OSR];
+
+	return conj(result) / gr_complex(length, 0);
+}
+
+/* Computes autocorrelation for positive arguments */
+inline void autocorrelation(const gr_complex *input, gr_complex *out, int nitems)
+{
+	for (int k = nitems - 1; k >= 0; k--) {
+		out[k] = gr_complex(0, 0);
+		for (int i = k; i < nitems; i++)
+			out[k] += input[i] * conj(input[i - k]);
+	}
+}
+
+inline void mafi(const gr_complex *input, int nitems, gr_complex *filter, int filter_length, gr_complex *output)
+{
+	for (int n = 0; n < nitems; n++) {
+		int a = n * d_OSR;
+		output[n] = 0;
+
+		for (int ii = 0; ii < filter_length; ii++) {
+			if ((a + ii) >= nitems * d_OSR)
+				break;
+
+			output[n] += input[a + ii] * filter[ii];
+		}
+	}
+}
+
+int get_chan_imp_resp(const gr_complex *input, gr_complex *chan_imp_resp, int search_start_pos, int search_stop_pos,
+		      gr_complex *tseq, int tseqlen, float *corr_max)
+{
+	const int num_search_windows = search_stop_pos - search_start_pos;
+	const int power_search_window_len = d_chan_imp_length * d_OSR;
+	std::vector<float> window_energy_buffer;
+	std::vector<float> power_buffer;
+	std::vector<gr_complex> correlation_buffer;
+
+	power_buffer.reserve(num_search_windows);
+	correlation_buffer.reserve(num_search_windows);
+	window_energy_buffer.reserve(num_search_windows);
+
+	for (int ii = 0; ii < num_search_windows; ii++) {
+		gr_complex correlation = correlate_sequence(tseq, tseqlen, &input[search_start_pos + ii]);
+		correlation_buffer.push_back(correlation);
+		power_buffer.push_back(std::pow(abs(correlation), 2));
+	}
+
+	/* Compute window energies */
+	float windowSum = 0;
+
+	// first window
+	for (int i = 0; i < power_search_window_len; i++) {
+		windowSum += power_buffer[i];
+	}
+	window_energy_buffer.push_back(windowSum);
+
+	// slide windows
+	for (int i = power_search_window_len; i < num_search_windows; i++) {
+		windowSum += power_buffer[i] - power_buffer[i - power_search_window_len];
+		window_energy_buffer.push_back(windowSum);
+	}
+
+	int strongest_window_nr = std::max_element(window_energy_buffer.begin(), window_energy_buffer.end()) -
+				  window_energy_buffer.begin();
+
+	float max_correlation = 0;
+	for (int ii = 0; ii < power_search_window_len; ii++) {
+		gr_complex correlation = correlation_buffer[strongest_window_nr + ii];
+		if (abs(correlation) > max_correlation)
+			max_correlation = abs(correlation);
+		chan_imp_resp[ii] = correlation;
+	}
+
+	*corr_max = max_correlation;
+
+	/**
+	 * Compute first sample position, which corresponds
+	 * to the first sample of the impulse response
+	 */
+	return search_start_pos + strongest_window_nr;
+}
+
+/*
+8 ext tail bits
+41 sync seq
+36 encrypted bits
+3 tail bits
+68.25 extended tail bits (!)
+
+center at 8+5 (actually known tb -> known isi, start at 8?) FIXME
+*/
+int get_access_imp_resp(const gr_complex *input, gr_complex *chan_imp_resp, float *corr_max, int max_delay)
+{
+	const int search_center = 8 + 5;
+	const int search_start_pos = (search_center - 5) * d_OSR + 1;
+	const int search_stop_pos = (search_center + 5 + d_chan_imp_length + max_delay) * d_OSR;
+	const auto tseq = &d_acc_training_seq[TRAIN_BEGINNING];
+	const auto tseqlen = N_ACCESS_BITS - (2 * TRAIN_BEGINNING);
+	return get_chan_imp_resp(input, chan_imp_resp, search_start_pos, search_stop_pos, tseq, tseqlen, corr_max) -
+	       search_center * d_OSR;
+}
+
+/*
+
+3 + 57 + 1 + 26 + 1 + 57 + 3 + 8.25
+
+search center = 3 + 57 + 1 + 5 (due to tsc 5+16+5 split)
+this is +-5 samples around (+5 beginning) of truncated t16 tsc
+
+*/
+int get_norm_chan_imp_resp(const gr_complex *input, gr_complex *chan_imp_resp, float *corr_max, int bcc)
+{
+	const int search_center = TRAIN_POS;
+	const int search_start_pos = (search_center - 5) * d_OSR + 1;
+	const int search_stop_pos = (search_center + 5 + d_chan_imp_length) * d_OSR;
+	const auto tseq = &d_norm_training_seq[bcc][TRAIN_BEGINNING];
+	const auto tseqlen = N_TRAIN_BITS - (2 * TRAIN_BEGINNING);
+	return get_chan_imp_resp(input, chan_imp_resp, search_start_pos, search_stop_pos, tseq, tseqlen, corr_max) -
+	       search_center * d_OSR;
+}
+
+/*
+
+3 tail | 39 data | 64 tsc | 39 data | 3 tail | 8.25 guard
+start 3+39 - 10
+end 3+39 + SYNC_SEARCH_RANGE
+
+*/
+int get_sch_chan_imp_resp(const gr_complex *input, gr_complex *chan_imp_resp)
+{
+	const int search_center = SYNC_POS + TRAIN_BEGINNING;
+	const int search_start_pos = (search_center - 10) * d_OSR;
+	const int search_stop_pos = (search_center + SYNC_SEARCH_RANGE) * d_OSR;
+	const auto tseq = &d_sch_training_seq[TRAIN_BEGINNING];
+	const auto tseqlen = N_SYNC_BITS - (2 * TRAIN_BEGINNING);
+
+	// strongest_window_nr + chan_imp_resp_center + SYNC_POS *d_OSR - 48 * d_OSR - 2 * d_OSR + 2 ;
+	float corr_max;
+	return get_chan_imp_resp(input, chan_imp_resp, search_start_pos, search_stop_pos, tseq, tseqlen, &corr_max) -
+	       search_center * d_OSR;
+	;
+}
+
+int get_sch_buffer_chan_imp_resp(const gr_complex *input, gr_complex *chan_imp_resp, unsigned int len, float *corr_max)
+{
+	const auto tseqlen = N_SYNC_BITS - (2 * TRAIN_BEGINNING);
+	const int search_center = SYNC_POS + TRAIN_BEGINNING;
+	const int search_start_pos = 0;
+	// FIXME: proper end offset
+	const int search_stop_pos = len - (N_SYNC_BITS * 8);
+	auto tseq = &d_sch_training_seq[TRAIN_BEGINNING];
+
+	return get_chan_imp_resp(input, chan_imp_resp, search_start_pos, search_stop_pos, tseq, tseqlen, corr_max) -
+	       search_center * d_OSR;
+}
--- a/Transceiver52M/grgsm_vitac/grgsm_vitac.h
+++ b/Transceiver52M/grgsm_vitac/grgsm_vitac.h
@@ -0,0 +1,89 @@
+#pragma once
+/* -*- c++ -*- */
+/*
+ * @file
+ * @author (C) 2009-2017  by Piotr Krysik <ptrkrysik@gmail.com>
+ * @section LICENSE
+ *
+ * Gr-gsm is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3, or (at your option)
+ * any later version.
+ *
+ * Gr-gsm is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with gr-gsm; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include <vector>
+#include "constants.h"
+
+/* may only be used for for the DEFINITIONS!
+* see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91664
+*/
+#if defined(__has_attribute)
+#if __has_attribute(target_clones) && defined(__x86_64) && true
+#define MULTI_VER_TARGET_ATTR __attribute__((target_clones("avx", "sse4.2", "sse3", "sse2", "sse", "default")))
+#else
+#define MULTI_VER_TARGET_ATTR
+#endif
+#endif
+
+/* ... but apparently clang disagrees... */
+#if defined(__clang__)
+#define MULTI_VER_TARGET_ATTR_CLANGONLY MULTI_VER_TARGET_ATTR
+#else
+#define MULTI_VER_TARGET_ATTR_CLANGONLY
+#endif
+
+/* ancient gcc < 8 has no attribute, clang always pretends to be gcc 4 */
+#if !defined(__clang__) && __GNUC__ < 8
+#define NO_UBSAN __attribute__((no_sanitize_undefined))
+#else
+#if defined(__has_attribute)
+#if __has_attribute(no_sanitize)
+#define NO_UBSAN __attribute__((no_sanitize("undefined")))
+#endif
+#else
+#define NO_UBSAN
+#endif
+#endif
+
+#define SYNC_SEARCH_RANGE 30
+const int d_OSR(4);
+
+void initvita();
+
+int process_vita_burst(gr_complex *input, int tsc, unsigned char *output_binary);
+int process_vita_sc_burst(gr_complex *input, int tsc, unsigned char *output_binary, int *offset);
+
+void detect_burst_nb(const gr_complex *input, gr_complex *chan_imp_resp, int burst_start, char *output_binary, int ss);
+void detect_burst_ab(const gr_complex *input, gr_complex *chan_imp_resp, int burst_start, char *output_binary, int ss);
+void detect_burst_nb(const gr_complex *input, gr_complex *chan_imp_resp, int burst_start, char *output_binary);
+void detect_burst_ab(const gr_complex *input, gr_complex *chan_imp_resp, int burst_start, char *output_binary);
+
+void gmsk_mapper(const unsigned char *input, int nitems, gr_complex *gmsk_output, gr_complex start_point);
+gr_complex correlate_sequence(const gr_complex *sequence, int length, const gr_complex *input);
+inline void autocorrelation(const gr_complex *input, gr_complex *out, int nitems);
+inline void mafi(const gr_complex *input, int nitems, gr_complex *filter, int filter_length, gr_complex *output);
+int get_sch_chan_imp_resp(const gr_complex *input, gr_complex *chan_imp_resp);
+int get_norm_chan_imp_resp(const gr_complex *input, gr_complex *chan_imp_resp, float *corr_max, int bcc);
+int get_sch_buffer_chan_imp_resp(const gr_complex *input, gr_complex *chan_imp_resp, unsigned int len, float *corr_max);
+int get_access_imp_resp(const gr_complex *input, gr_complex *chan_imp_resp, float *corr_max, int max_delay);
+
+enum class btype { NB, SCH };
+struct fdata {
+	btype t;
+	unsigned int fn;
+	int tn;
+	int bcc;
+	std::string fpath;
+	std::vector<gr_complex> data;
+	unsigned int data_start_offset;
+};
--- a/Transceiver52M/grgsm_vitac/viterbi_detector.cc
+++ b/Transceiver52M/grgsm_vitac/viterbi_detector.cc
@@ -0,0 +1,392 @@
+/* -*- c++ -*- */
+/*
+ * @file
+ * @author (C) 2009 by Piotr Krysik <ptrkrysik@gmail.com>
+ * @section LICENSE
+ *
+ * Gr-gsm is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3, or (at your option)
+ * any later version.
+ *
+ * Gr-gsm is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with gr-gsm; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street,
+ * Boston, MA 02110-1301, USA.
+ */
+
+/*
+ * viterbi_detector:
+ *           This part does the detection of received sequnece.
+ *           Employed algorithm is viterbi Maximum Likehood Sequence Estimation.
+ *           At this moment it gives hard decisions on the output, but
+ *           it was designed with soft decisions in mind.
+ *
+ * SYNTAX:   void viterbi_detector(
+ *                                  const gr_complex * input, 
+ *                                  unsigned int samples_num, 
+ *                                  gr_complex * rhh, 
+ *                                  unsigned int start_state, 
+ *                                  const unsigned int * stop_states, 
+ *                                  unsigned int stops_num, 
+ *                                  float * output)
+ *
+ * INPUT:    input:       Complex received signal afted matched filtering.
+ *           samples_num: Number of samples in the input table.
+ *           rhh:         The autocorrelation of the estimated channel 
+ *                        impulse response.
+ *           start_state: Number of the start point. In GSM each burst 
+ *                        starts with sequence of three bits (0,0,0) which 
+ *                        indicates start point of the algorithm.
+ *           stop_states: Table with numbers of possible stop states.
+ *           stops_num:   Number of possible stop states
+ *                     
+ *
+ * OUTPUT:   output:      Differentially decoded hard output of the algorithm: 
+ *                        -1 for logical "0" and 1 for logical "1"
+ *
+ * SUB_FUNC: none
+ *
+ * TEST(S):  Tested with real world normal burst.
+ */
+
+#include "constants.h"
+#include <cmath>
+
+#define PATHS_NUM (1 << (CHAN_IMP_RESP_LENGTH-1))
+
+void viterbi_detector(const gr_complex * input, unsigned int samples_num, gr_complex * rhh, unsigned int start_state, const unsigned int * stop_states, unsigned int stops_num, float * output)
+{
+   float increment[8];
+   float path_metrics1[16];
+   float path_metrics2[16];
+   float paths_difference;
+   float * new_path_metrics;
+   float * old_path_metrics;
+   float * tmp;
+   float trans_table[BURST_SIZE][16];
+   float pm_candidate1, pm_candidate2;
+   bool real_imag;
+   float input_symbol_real, input_symbol_imag;
+   unsigned int i, sample_nr;
+
+/*
+* Setup first path metrics, so only state pointed by start_state is possible.
+* Start_state metric is equal to zero, the rest is written with some very low value,
+* which makes them practically impossible to occur.
+*/
+   for(i=0; i<PATHS_NUM; i++){
+      path_metrics1[i]=(-10e30);
+   }
+   path_metrics1[start_state]=0;
+
+/*
+* Compute Increment - a table of values which does not change for subsequent input samples.
+* Increment is table of reference levels for computation of branch metrics:
+*    branch metric = (+/-)received_sample (+/-) reference_level
+*/
+   increment[0] = -rhh[1].imag() -rhh[2].real() -rhh[3].imag() +rhh[4].real();
+   increment[1] = rhh[1].imag() -rhh[2].real() -rhh[3].imag() +rhh[4].real();
+   increment[2] = -rhh[1].imag() +rhh[2].real() -rhh[3].imag() +rhh[4].real();
+   increment[3] = rhh[1].imag() +rhh[2].real() -rhh[3].imag() +rhh[4].real();
+   increment[4] = -rhh[1].imag() -rhh[2].real() +rhh[3].imag() +rhh[4].real();
+   increment[5] = rhh[1].imag() -rhh[2].real() +rhh[3].imag() +rhh[4].real();
+   increment[6] = -rhh[1].imag() +rhh[2].real() +rhh[3].imag() +rhh[4].real();
+   increment[7] = rhh[1].imag() +rhh[2].real() +rhh[3].imag() +rhh[4].real();
+
+
+/*
+* Computation of path metrics and decisions (Add-Compare-Select).
+* It's composed of two parts: one for odd input samples (imaginary numbers)
+* and one for even samples (real numbers).
+* Each part is composed of independent (parallelisable) statements like  
+* this one:
+*      pm_candidate1 = old_path_metrics[0] -input_symbol_imag +increment[2];
+*      pm_candidate2 = old_path_metrics[8] -input_symbol_imag -increment[5];
+*      paths_difference=pm_candidate2-pm_candidate1;
+*      new_path_metrics[1]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+*      trans_table[sample_nr][1] = paths_difference;
+* This is very good point for optimisations (SIMD or OpenMP) as it's most time 
+* consuming part of this function. 
+*/
+   sample_nr=0;
+   old_path_metrics=path_metrics1;
+   new_path_metrics=path_metrics2;
+   while(sample_nr<samples_num){
+      //Processing imag states
+      real_imag=1;
+      input_symbol_imag = input[sample_nr].imag();
+
+      pm_candidate1 = old_path_metrics[0] +input_symbol_imag -increment[2];
+      pm_candidate2 = old_path_metrics[8] +input_symbol_imag +increment[5];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[0]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][0] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[0] -input_symbol_imag +increment[2];
+      pm_candidate2 = old_path_metrics[8] -input_symbol_imag -increment[5];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[1]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][1] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[1] +input_symbol_imag -increment[3];
+      pm_candidate2 = old_path_metrics[9] +input_symbol_imag +increment[4];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[2]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][2] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[1] -input_symbol_imag +increment[3];
+      pm_candidate2 = old_path_metrics[9] -input_symbol_imag -increment[4];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[3]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][3] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[2] +input_symbol_imag -increment[0];
+      pm_candidate2 = old_path_metrics[10] +input_symbol_imag +increment[7];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[4]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][4] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[2] -input_symbol_imag +increment[0];
+      pm_candidate2 = old_path_metrics[10] -input_symbol_imag -increment[7];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[5]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][5] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[3] +input_symbol_imag -increment[1];
+      pm_candidate2 = old_path_metrics[11] +input_symbol_imag +increment[6];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[6]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][6] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[3] -input_symbol_imag +increment[1];
+      pm_candidate2 = old_path_metrics[11] -input_symbol_imag -increment[6];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[7]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][7] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[4] +input_symbol_imag -increment[6];
+      pm_candidate2 = old_path_metrics[12] +input_symbol_imag +increment[1];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[8]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][8] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[4] -input_symbol_imag +increment[6];
+      pm_candidate2 = old_path_metrics[12] -input_symbol_imag -increment[1];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[9]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][9] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[5] +input_symbol_imag -increment[7];
+      pm_candidate2 = old_path_metrics[13] +input_symbol_imag +increment[0];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[10]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][10] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[5] -input_symbol_imag +increment[7];
+      pm_candidate2 = old_path_metrics[13] -input_symbol_imag -increment[0];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[11]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][11] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[6] +input_symbol_imag -increment[4];
+      pm_candidate2 = old_path_metrics[14] +input_symbol_imag +increment[3];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[12]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][12] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[6] -input_symbol_imag +increment[4];
+      pm_candidate2 = old_path_metrics[14] -input_symbol_imag -increment[3];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[13]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][13] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[7] +input_symbol_imag -increment[5];
+      pm_candidate2 = old_path_metrics[15] +input_symbol_imag +increment[2];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[14]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][14] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[7] -input_symbol_imag +increment[5];
+      pm_candidate2 = old_path_metrics[15] -input_symbol_imag -increment[2];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[15]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][15] = paths_difference;
+      tmp=old_path_metrics;
+      old_path_metrics=new_path_metrics;
+      new_path_metrics=tmp;
+
+      sample_nr++;
+      if(sample_nr==samples_num)
+         break;
+
+      //Processing real states
+      real_imag=0;
+      input_symbol_real = input[sample_nr].real();
+
+      pm_candidate1 = old_path_metrics[0] -input_symbol_real -increment[7];
+      pm_candidate2 = old_path_metrics[8] -input_symbol_real +increment[0];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[0]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][0] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[0] +input_symbol_real +increment[7];
+      pm_candidate2 = old_path_metrics[8] +input_symbol_real -increment[0];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[1]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][1] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[1] -input_symbol_real -increment[6];
+      pm_candidate2 = old_path_metrics[9] -input_symbol_real +increment[1];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[2]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][2] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[1] +input_symbol_real +increment[6];
+      pm_candidate2 = old_path_metrics[9] +input_symbol_real -increment[1];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[3]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][3] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[2] -input_symbol_real -increment[5];
+      pm_candidate2 = old_path_metrics[10] -input_symbol_real +increment[2];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[4]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][4] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[2] +input_symbol_real +increment[5];
+      pm_candidate2 = old_path_metrics[10] +input_symbol_real -increment[2];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[5]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][5] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[3] -input_symbol_real -increment[4];
+      pm_candidate2 = old_path_metrics[11] -input_symbol_real +increment[3];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[6]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][6] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[3] +input_symbol_real +increment[4];
+      pm_candidate2 = old_path_metrics[11] +input_symbol_real -increment[3];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[7]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][7] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[4] -input_symbol_real -increment[3];
+      pm_candidate2 = old_path_metrics[12] -input_symbol_real +increment[4];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[8]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][8] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[4] +input_symbol_real +increment[3];
+      pm_candidate2 = old_path_metrics[12] +input_symbol_real -increment[4];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[9]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][9] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[5] -input_symbol_real -increment[2];
+      pm_candidate2 = old_path_metrics[13] -input_symbol_real +increment[5];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[10]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][10] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[5] +input_symbol_real +increment[2];
+      pm_candidate2 = old_path_metrics[13] +input_symbol_real -increment[5];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[11]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][11] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[6] -input_symbol_real -increment[1];
+      pm_candidate2 = old_path_metrics[14] -input_symbol_real +increment[6];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[12]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][12] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[6] +input_symbol_real +increment[1];
+      pm_candidate2 = old_path_metrics[14] +input_symbol_real -increment[6];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[13]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][13] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[7] -input_symbol_real -increment[0];
+      pm_candidate2 = old_path_metrics[15] -input_symbol_real +increment[7];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[14]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][14] = paths_difference;
+
+      pm_candidate1 = old_path_metrics[7] +input_symbol_real +increment[0];
+      pm_candidate2 = old_path_metrics[15] +input_symbol_real -increment[7];
+      paths_difference=pm_candidate2-pm_candidate1;
+      new_path_metrics[15]=(paths_difference<0) ? pm_candidate1 : pm_candidate2;
+      trans_table[sample_nr][15] = paths_difference;
+
+      tmp=old_path_metrics;
+      old_path_metrics=new_path_metrics;
+      new_path_metrics=tmp;
+
+      sample_nr++;
+   }
+
+/*
+* Find the best from the stop states by comparing their path metrics.
+* Not every stop state is always possible, so we are searching in
+* a subset of them.
+*/
+   unsigned int best_stop_state;
+   float stop_state_metric, max_stop_state_metric;
+   best_stop_state = stop_states[0];
+   max_stop_state_metric = old_path_metrics[best_stop_state];
+   for(i=1; i< stops_num; i++){
+      stop_state_metric = old_path_metrics[stop_states[i]];
+      if(stop_state_metric > max_stop_state_metric){
+         max_stop_state_metric = stop_state_metric;
+         best_stop_state = stop_states[i];
+      }
+   }
+
+/*
+* This table was generated with hope that it gives a litle speedup during
+* traceback stage. 
+* Received bit is related to the number of state in the trellis.
+* I've numbered states so their parity (number of ones) is related
+* to a received bit. 
+*/
+   static const unsigned int parity_table[PATHS_NUM] = { 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0,  };
+
+/*
+* Table of previous states in the trellis diagram.
+* For GMSK modulation every state has two previous states.
+* Example:
+*   previous_state_nr1 = prev_table[current_state_nr][0]
+*   previous_state_nr2 = prev_table[current_state_nr][1]
+*/
+   static const unsigned int prev_table[PATHS_NUM][2] = { {0,8}, {0,8}, {1,9}, {1,9}, {2,10}, {2,10}, {3,11}, {3,11}, {4,12}, {4,12}, {5,13}, {5,13}, {6,14}, {6,14}, {7,15}, {7,15},  };
+
+/*
+* Traceback and differential decoding of received sequence.
+* Decisions stored in trans_table are used to restore best path in the trellis.
+*/
+   sample_nr=samples_num;
+   unsigned int state_nr=best_stop_state;
+   unsigned int decision;
+   bool out_bit=0;
+
+   while(sample_nr>0){
+      sample_nr--;
+      decision = (trans_table[sample_nr][state_nr]>0);
+
+      if(decision != out_bit)
+         output[sample_nr]=-trans_table[sample_nr][state_nr];
+      else
+         output[sample_nr]=trans_table[sample_nr][state_nr];
+
+      out_bit = out_bit ^ real_imag ^ parity_table[state_nr];
+      state_nr = prev_table[state_nr][decision];
+      real_imag = !real_imag;
+   }
+}
--- a/Transceiver52M/grgsm_vitac/viterbi_detector.h
+++ b/Transceiver52M/grgsm_vitac/viterbi_detector.h
@@ -0,0 +1,64 @@
+/* -*- c++ -*- */
+/*
+ * @file
+ * @author (C) 2009 Piotr Krysik <ptrkrysik@gmail.com>
+ * @section LICENSE
+ *
+ * Gr-gsm is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3, or (at your option)
+ * any later version.
+ *
+ * Gr-gsm is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with gr-gsm; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street,
+ * Boston, MA 02110-1301, USA.
+ */
+
+/*
+ * viterbi_detector:
+ *           This part does the detection of received sequnece.
+ *           Employed algorithm is viterbi Maximum Likehood Sequence Estimation.
+ *           At this moment it gives hard decisions on the output, but
+ *           it was designed with soft decisions in mind.
+ *
+ * SYNTAX:   void viterbi_detector(
+ *                                  const gr_complex * input, 
+ *                                  unsigned int samples_num, 
+ *                                  gr_complex * rhh, 
+ *                                  unsigned int start_state, 
+ *                                  const unsigned int * stop_states, 
+ *                                  unsigned int stops_num, 
+ *                                  float * output)
+ *
+ * INPUT:    input:       Complex received signal afted matched filtering.
+ *           samples_num: Number of samples in the input table.
+ *           rhh:         The autocorrelation of the estimated channel 
+ *                        impulse response.
+ *           start_state: Number of the start point. In GSM each burst 
+ *                        starts with sequence of three bits (0,0,0) which 
+ *                        indicates start point of the algorithm.
+ *           stop_states: Table with numbers of possible stop states.
+ *           stops_num:   Number of possible stop states
+ *                     
+ *
+ * OUTPUT:   output:      Differentially decoded hard output of the algorithm: 
+ *                        -1 for logical "0" and 1 for logical "1"
+ *
+ * SUB_FUNC: none
+ *
+ * TEST(S):  Tested with real world normal burst.
+ */
+
+#ifndef INCLUDED_VITERBI_DETECTOR_H
+#define INCLUDED_VITERBI_DETECTOR_H
+#include "constants.h"
+
+void viterbi_detector(const gr_complex * input, unsigned int samples_num, gr_complex * rhh, unsigned int start_state, const unsigned int * stop_states, unsigned int stops_num, float * output);
+
+#endif /* INCLUDED_VITERBI_DETECTOR_H */
--- a/Transceiver52M/ms/bladerf_specific.h
+++ b/Transceiver52M/ms/bladerf_specific.h
@@ -0,0 +1,479 @@
+#pragma once
+/*
+ * (C) 2022 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved
+ *
+ * Author: Eric Wild <ewild@sysmocom.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "itrq.h"
+#include <atomic>
+#include <complex>
+#include <cstdint>
+#include <functional>
+#include <iostream>
+#include <cassert>
+#include <cstring>
+
+#include <libbladeRF.h>
+#include <Timeval.h>
+#include <unistd.h>
+
+const size_t BLADE_BUFFER_SIZE = 1024 * 1;
+const size_t BLADE_NUM_BUFFERS = 32 * 1;
+const size_t NUM_TRANSFERS = 16 * 2;
+const int SAMPLE_SCALE_FACTOR = 15; // actually 16 but sigproc complains about clipping..
+
+// see https://en.cppreference.com/w/cpp/language/parameter_pack  "Brace-enclosed initializers" example
+template <typename Arg, typename... Args>
+void expand_args(std::ostream &out, Arg &&arg, Args &&...args)
+{
+	out << '(' << std::forward<Arg>(arg);
+	(void)(int[]){ 0, (void((out << "," << std::forward<Args>(args))), 0)... };
+	out << ')' << std::endl;
+}
+
+template <class R, class... Args>
+using RvalFunc = R (*)(Args...);
+
+template <class R, class... Args>
+R exec_and_check(RvalFunc<R, Args...> func, const char *fname, const char *finame, const char *funcname, int line,
+		 Args... args)
+{
+	R rval = func(std::forward<Args>(args)...);
+	if (rval != 0) {
+		std::cerr << ((rval >= 0) ? "OK:" : bladerf_strerror(rval)) << ':' << finame << ':' << line << ':'
+			  << funcname << ':' << fname;
+		expand_args(std::cerr, args...);
+	}
+	return rval;
+}
+
+// only macros can pass a func name string
+#define blade_check(func, ...) exec_and_check(func, #func, __FILE__, __FUNCTION__, __LINE__, __VA_ARGS__)
+
+#pragma pack(push, 1)
+using blade_sample_type = std::complex<int16_t>;
+enum class blade_speed_buffer_type { HS, SS };
+template <blade_speed_buffer_type T>
+struct blade_usb_message {
+	uint32_t reserved;
+	uint64_t ts;
+	uint32_t meta_flags;
+	blade_sample_type d[(T == blade_speed_buffer_type::SS ? 512 : 256) - 4];
+};
+
+static_assert(sizeof(blade_usb_message<blade_speed_buffer_type::SS>) == 2048, "blade buffer mismatch!");
+static_assert(sizeof(blade_usb_message<blade_speed_buffer_type::HS>) == 1024, "blade buffer mismatch!");
+template <unsigned int SZ, blade_speed_buffer_type T>
+struct blade_otw_buffer {
+	static_assert((SZ >= 2 && !(SZ % 2)), "min size is 2x usb buffer!");
+	blade_usb_message<T> m[SZ];
+	int actual_samples_per_msg()
+	{
+		return sizeof(blade_usb_message<T>::d) / sizeof(typeof(blade_usb_message<T>::d[0]));
+	}
+	int actual_samples_per_buffer()
+	{
+		return SZ * actual_samples_per_msg();
+	}
+	int samples_per_buffer()
+	{
+		return SZ * sizeof(blade_usb_message<T>) / sizeof(typeof(blade_usb_message<T>::d[0]));
+	}
+	int num_msgs_per_buffer()
+	{
+		return SZ;
+	}
+	auto get_first_ts()
+	{
+		return m[0].ts;
+	}
+	constexpr auto *getsampleoffset(int ofs)
+	{
+		auto full = ofs / actual_samples_per_msg();
+		auto rem = ofs % actual_samples_per_msg();
+		return &m[full].d[rem];
+	}
+	int readall(blade_sample_type *outaddr)
+	{
+		blade_sample_type *addr = outaddr;
+		for (unsigned int i = 0; i < SZ; i++) {
+			memcpy(addr, &m[i].d[0], actual_samples_per_msg() * sizeof(blade_sample_type));
+			addr += actual_samples_per_msg();
+		}
+		return actual_samples_per_buffer();
+	}
+	int read_n(blade_sample_type *outaddr, int start, int num)
+	{
+		assert((start + num) <= actual_samples_per_buffer());
+		assert(start >= 0);
+
+		if (!num)
+			return 0;
+
+		// which buffer?
+		int start_buf_idx = (start > 0) ? start / actual_samples_per_msg() : 0;
+		// offset from actual buffer start
+		auto start_offset_in_buf = (start - (start_buf_idx * actual_samples_per_msg()));
+		auto samp_rem_in_first_buf = actual_samples_per_msg() - start_offset_in_buf;
+		auto remaining_first_buf = num > samp_rem_in_first_buf ? samp_rem_in_first_buf : num;
+
+		memcpy(outaddr, &m[start_buf_idx].d[start_offset_in_buf],
+		       remaining_first_buf * sizeof(blade_sample_type));
+		outaddr += remaining_first_buf;
+
+		auto remaining = num - remaining_first_buf;
+
+		if (!remaining)
+			return num;
+
+		start_buf_idx++;
+
+		auto rem_full_bufs = remaining / actual_samples_per_msg();
+		remaining -= rem_full_bufs * actual_samples_per_msg();
+
+		for (int i = 0; i < rem_full_bufs; i++) {
+			memcpy(outaddr, &m[start_buf_idx++].d[0], actual_samples_per_msg() * sizeof(blade_sample_type));
+			outaddr += actual_samples_per_msg();
+		}
+
+		if (remaining)
+			memcpy(outaddr, &m[start_buf_idx].d[0], remaining * sizeof(blade_sample_type));
+		return num;
+	}
+	int write_n_burst(blade_sample_type *in, int num, uint64_t first_ts)
+	{
+		assert(num <= actual_samples_per_buffer());
+		int len_rem = num;
+		for (unsigned int i = 0; i < SZ; i++) {
+			m[i] = {};
+			m[i].ts = first_ts + i * actual_samples_per_msg();
+			if (len_rem) {
+				int max_to_copy =
+					len_rem > actual_samples_per_msg() ? actual_samples_per_msg() : len_rem;
+				memcpy(&m[i].d[0], in, max_to_copy * sizeof(blade_sample_type));
+				len_rem -= max_to_copy;
+				in += actual_samples_per_msg();
+			}
+		}
+		return num;
+	}
+};
+#pragma pack(pop)
+
+template <unsigned int SZ, blade_speed_buffer_type T>
+struct blade_otw_buffer_helper {
+	static_assert((SZ >= 1024 && ((SZ & (SZ - 1)) == 0)), "only buffer size multiples of 1024 allowed!");
+	static blade_otw_buffer<SZ / 512, T> x;
+};
+
+using dev_buf_t = typeof(blade_otw_buffer_helper<BLADE_BUFFER_SIZE, blade_speed_buffer_type::SS>::x);
+// using buf_in_use = blade_otw_buffer<2, blade_speed_buffer_type::SS>;
+using bh_fn_t = std::function<int(dev_buf_t *)>;
+
+template <typename T>
+struct blade_hw {
+	struct bladerf *dev;
+	struct bladerf_stream *rx_stream;
+	struct bladerf_stream *tx_stream;
+	// using pkt2buf = blade_otw_buffer<2, blade_speed_buffer_type::SS>;
+	using tx_buf_q_type = spsc_cond_timeout<BLADE_NUM_BUFFERS, dev_buf_t *, true, false>;
+	const unsigned int rxFullScale, txFullScale;
+	const int rxtxdelay;
+
+	float rxgain, txgain;
+	static std::atomic<bool> stop_lower_threads_flag;
+	double rxfreq_cache, txfreq_cache;
+
+	struct ms_trx_config {
+		int tx_freq;
+		int rx_freq;
+		int sample_rate;
+		int bandwidth;
+
+	    public:
+		ms_trx_config() : tx_freq(881e6), rx_freq(926e6), sample_rate(((1625e3 / 6) * 4)), bandwidth(1e6)
+		{
+		}
+	} cfg;
+
+	struct buf_mgmt {
+		void **rx_samples;
+		void **tx_samples;
+		tx_buf_q_type bufptrqueue;
+
+	} buf_mgmt;
+
+	virtual ~blade_hw()
+	{
+		close_device();
+	}
+	blade_hw()
+		: rxFullScale(2047), txFullScale(2047), rxtxdelay(-60), rxgain(30), txgain(30), rxfreq_cache(0),
+		  txfreq_cache(0)
+	{
+	}
+
+	void close_device()
+	{
+		if (dev) {
+			if (tx_stream) {
+				bladerf_deinit_stream(tx_stream);
+			}
+
+			if (rx_stream) {
+				bladerf_deinit_stream(rx_stream);
+			}
+
+			bladerf_enable_module(dev, BLADERF_MODULE_RX, false);
+			bladerf_enable_module(dev, BLADERF_MODULE_TX, false);
+
+			bladerf_close(dev);
+			dev = NULL;
+		}
+	}
+
+	int init_device(bh_fn_t rxh, bh_fn_t txh)
+	{
+		struct bladerf_rational_rate rate = { 0, static_cast<uint64_t>((1625e3 * 4)) * 64, 6 * 64 }, actual;
+
+		bladerf_log_set_verbosity(BLADERF_LOG_LEVEL_DEBUG);
+		bladerf_set_usb_reset_on_open(true);
+
+		blade_check(bladerf_open, &dev, "");
+		if (!dev) {
+			std::cerr << "open failed, device missing?" << std::endl;
+			exit(0);
+		}
+		if (bladerf_device_speed(dev) != bladerf_dev_speed::BLADERF_DEVICE_SPEED_SUPER) {
+			std::cerr << "open failed, only superspeed (usb3) supported!" << std::endl;
+			return -1;
+		}
+
+		blade_check(bladerf_set_tuning_mode, dev, bladerf_tuning_mode::BLADERF_TUNING_MODE_FPGA);
+
+		bool is_locked;
+		blade_check(bladerf_set_pll_enable, dev, true);
+		uint64_t refclock = 10000000UL;
+		blade_check(bladerf_set_pll_refclk, dev, refclock);
+		for (int i = 0; i < 20; i++) {
+			usleep(50 * 1000);
+			bladerf_get_pll_lock_state(dev, &is_locked);
+
+			if (is_locked)
+				break;
+		}
+		if (!is_locked) {
+			std::cerr << "unable to lock refclk!" << std::endl;
+			return -1;
+		}
+
+		blade_check(bladerf_set_rational_sample_rate, dev, BLADERF_CHANNEL_RX(0), &rate, &actual);
+		blade_check(bladerf_set_rational_sample_rate, dev, BLADERF_CHANNEL_TX(0), &rate, &actual);
+
+		blade_check(bladerf_set_frequency, dev, BLADERF_CHANNEL_RX(0), (bladerf_frequency)cfg.rx_freq);
+		blade_check(bladerf_set_frequency, dev, BLADERF_CHANNEL_TX(0), (bladerf_frequency)cfg.tx_freq);
+
+		blade_check(bladerf_set_bandwidth, dev, BLADERF_CHANNEL_RX(0), (bladerf_bandwidth)cfg.bandwidth,
+			    (bladerf_bandwidth *)NULL);
+		blade_check(bladerf_set_bandwidth, dev, BLADERF_CHANNEL_TX(0), (bladerf_bandwidth)cfg.bandwidth,
+			    (bladerf_bandwidth *)NULL);
+
+		blade_check(bladerf_set_gain_mode, dev, BLADERF_CHANNEL_RX(0), BLADERF_GAIN_MGC);
+		setRxGain(rxgain, 0);
+		setTxGain(txgain, 0);
+		usleep(1000);
+
+		bladerf_set_stream_timeout(dev, BLADERF_TX, 10);
+		bladerf_set_stream_timeout(dev, BLADERF_RX, 10);
+
+		blade_check(bladerf_init_stream, &rx_stream, dev, getrxcb(rxh), &buf_mgmt.rx_samples, BLADE_NUM_BUFFERS,
+			    BLADERF_FORMAT_SC16_Q11_META, BLADE_BUFFER_SIZE, NUM_TRANSFERS, (void *)this);
+
+		blade_check(bladerf_init_stream, &tx_stream, dev, gettxcb(txh), &buf_mgmt.tx_samples, BLADE_NUM_BUFFERS,
+			    BLADERF_FORMAT_SC16_Q11_META, BLADE_BUFFER_SIZE, NUM_TRANSFERS, (void *)this);
+
+		for (unsigned int i = 0; i < BLADE_NUM_BUFFERS; i++) {
+			auto cur_buffer = reinterpret_cast<tx_buf_q_type::elem_t *>(buf_mgmt.tx_samples);
+			buf_mgmt.bufptrqueue.spsc_push(&cur_buffer[i]);
+		}
+
+		return 0;
+	}
+
+	void actually_enable_streams()
+	{
+		blade_check(bladerf_enable_module, dev, BLADERF_MODULE_RX, true);
+		usleep(1000);
+		blade_check(bladerf_enable_module, dev, BLADERF_MODULE_TX, true);
+	}
+
+	bool tuneTx(double freq, size_t chan = 0)
+	{
+		if (txfreq_cache == freq)
+			return true;
+		msleep(15);
+		blade_check(bladerf_set_frequency, dev, BLADERF_CHANNEL_TX(0), (bladerf_frequency)freq);
+		txfreq_cache = freq;
+		msleep(15);
+		return true;
+	};
+	bool tuneRx(double freq, size_t chan = 0)
+	{
+		if (rxfreq_cache == freq)
+			return true;
+		msleep(15);
+		blade_check(bladerf_set_frequency, dev, BLADERF_CHANNEL_RX(0), (bladerf_frequency)freq);
+		rxfreq_cache = freq;
+		msleep(15);
+		return true;
+	};
+	bool tuneRxOffset(double offset, size_t chan = 0)
+	{
+		return true;
+	};
+
+	double setRxGain(double dB, size_t chan = 0)
+	{
+		rxgain = dB;
+		msleep(15);
+		blade_check(bladerf_set_gain, dev, BLADERF_CHANNEL_RX(0), (bladerf_gain)dB);
+		msleep(15);
+		return dB;
+	};
+	double setTxGain(double dB, size_t chan = 0)
+	{
+		txgain = dB;
+		msleep(15);
+		blade_check(bladerf_set_gain, dev, BLADERF_CHANNEL_TX(0), (bladerf_gain)dB);
+		msleep(15);
+		return dB;
+	};
+	int setPowerAttenuation(int atten, size_t chan = 0)
+	{
+		return atten;
+	};
+
+	static void check_timestamp(dev_buf_t *rcd)
+	{
+		static bool first = true;
+		static uint64_t last_ts;
+		if (first) {
+			first = false;
+			last_ts = rcd->m[0].ts;
+		} else if (last_ts + rcd->actual_samples_per_buffer() != rcd->m[0].ts) {
+			std::cerr << "RX Overrun!" << last_ts << " " << rcd->actual_samples_per_buffer() << " "
+				  << last_ts + rcd->actual_samples_per_buffer() << " " << rcd->m[0].ts << std::endl;
+			last_ts = rcd->m[0].ts;
+		} else {
+			last_ts = rcd->m[0].ts;
+		}
+	}
+
+	bladerf_stream_cb getrxcb(bh_fn_t rxbh)
+	{
+		// C cb -> no capture!
+		static auto rxbhfn = rxbh;
+		return [](struct bladerf *dev, struct bladerf_stream *stream, struct bladerf_metadata *meta,
+			  void *samples, size_t num_samples, void *user_data) -> void * {
+			// struct blade_hw *trx = (struct blade_hw *)user_data;
+			static int to_skip = 0;
+			dev_buf_t *rcd = (dev_buf_t *)samples;
+
+			if (stop_lower_threads_flag)
+				return BLADERF_STREAM_SHUTDOWN;
+
+			if (to_skip < 120) // prevents weird overflows on startup
+				to_skip++;
+			else {
+				check_timestamp(rcd);
+				rxbhfn(rcd);
+			}
+
+			return samples;
+		};
+	}
+	bladerf_stream_cb gettxcb(bh_fn_t txbh)
+	{
+		// C cb -> no capture!
+		static auto txbhfn = txbh;
+		return [](struct bladerf *dev, struct bladerf_stream *stream, struct bladerf_metadata *meta,
+			  void *samples, size_t num_samples, void *user_data) -> void * {
+			struct blade_hw *trx = (struct blade_hw *)user_data;
+			auto ptr = reinterpret_cast<tx_buf_q_type::elem_t>(samples);
+
+			if (samples) // put buffer address back into queue, ready to be reused
+				trx->buf_mgmt.bufptrqueue.spsc_push(&ptr);
+
+			if (stop_lower_threads_flag)
+				return BLADERF_STREAM_SHUTDOWN;
+
+			return BLADERF_STREAM_NO_DATA;
+		};
+	}
+
+	auto get_rx_burst_handler_fn(bh_fn_t burst_handler)
+	{
+		using thist = decltype(this);
+		auto fn = [](void *args) -> void * {
+			thist t = reinterpret_cast<thist>(args);
+			int status = 0;
+			if (!stop_lower_threads_flag)
+				status = bladerf_stream(t->rx_stream, BLADERF_RX_X1);
+			if (status < 0)
+				std::cerr << "rx stream error! " << bladerf_strerror(status) << std::endl;
+
+			return 0;
+		};
+		return fn;
+	}
+	auto get_tx_burst_handler_fn(bh_fn_t burst_handler)
+	{
+		using thist = decltype(this);
+		auto fn = [](void *args) -> void * {
+			thist t = reinterpret_cast<thist>(args);
+			int status = 0;
+			if (!stop_lower_threads_flag)
+				status = bladerf_stream(t->tx_stream, BLADERF_TX_X1);
+			if (status < 0)
+				std::cerr << "rx stream error! " << bladerf_strerror(status) << std::endl;
+
+			return 0;
+		};
+		return fn;
+	}
+
+	void submit_burst_ts(blade_sample_type *buffer, int len, uint64_t ts)
+	{
+		tx_buf_q_type::elem_t rcd;
+
+		// exit by submitting a dummy buffer to assure the libbladerf stream mutex is happy (thread!)
+		if (!buffer) {
+			bladerf_submit_stream_buffer(tx_stream, (void *)BLADERF_STREAM_SHUTDOWN, 1000);
+			return;
+		}
+
+		//get empty bufer from list
+		while (!buf_mgmt.bufptrqueue.spsc_pop(&rcd))
+			buf_mgmt.bufptrqueue.spsc_prep_pop();
+		assert(rcd != nullptr);
+
+		rcd->write_n_burst(buffer, len, ts + rxtxdelay); // blade xa4 specific delay!
+		blade_check(bladerf_submit_stream_buffer_nb, tx_stream, (void *)rcd);
+	}
+};
--- a/Transceiver52M/ms/itrq.h
+++ b/Transceiver52M/ms/itrq.h
@@ -0,0 +1,249 @@
+#pragma once
+/*
+ * (C) 2022 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved
+ *
+ * Author: Eric Wild <ewild@sysmocom.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <atomic>
+
+#include <condition_variable>
+#include <mutex>
+#include <sys/eventfd.h>
+#include <unistd.h>
+
+namespace spsc_detail
+{
+template <bool block_read, bool block_write>
+class spsc_cond_timeout_detail {
+	std::condition_variable cond_r, cond_w;
+	std::mutex lr, lw;
+	std::atomic_int r_flag, w_flag;
+	const int timeout_ms = 200;
+
+    public:
+	explicit spsc_cond_timeout_detail() : r_flag(0), w_flag(0)
+	{
+	}
+
+	~spsc_cond_timeout_detail()
+	{
+	}
+
+	ssize_t spsc_check_r()
+	{
+		std::unique_lock<std::mutex> lk(lr);
+		if (cond_r.wait_for(lk, std::chrono::milliseconds(timeout_ms), [&] { return r_flag != 0; })) {
+			r_flag--;
+			return 1;
+		} else {
+			return 0;
+		}
+	}
+	ssize_t spsc_check_w()
+	{
+		std::unique_lock<std::mutex> lk(lw);
+		if (cond_w.wait_for(lk, std::chrono::milliseconds(timeout_ms), [&] { return w_flag != 0; })) {
+			w_flag--;
+			return 1;
+		} else {
+			return 0;
+		}
+	}
+	void spsc_notify_r()
+	{
+		std::unique_lock<std::mutex> lk(lr);
+		r_flag++;
+		cond_r.notify_one();
+	}
+	void spsc_notify_w()
+	{
+		std::unique_lock<std::mutex> lk(lw);
+		w_flag++;
+		cond_w.notify_one();
+	}
+};
+
+template <bool block_read, bool block_write>
+class spsc_cond_detail {
+	std::condition_variable cond_r, cond_w;
+	std::mutex lr, lw;
+	std::atomic_int r_flag, w_flag;
+
+    public:
+	explicit spsc_cond_detail() : r_flag(0), w_flag(0)
+	{
+	}
+
+	~spsc_cond_detail()
+	{
+	}
+
+	ssize_t spsc_check_r()
+	{
+		std::unique_lock<std::mutex> lk(lr);
+		while (r_flag == 0)
+			cond_r.wait(lk);
+		r_flag--;
+		return 1;
+	}
+	ssize_t spsc_check_w()
+	{
+		std::unique_lock<std::mutex> lk(lw);
+		while (w_flag == 0)
+			cond_w.wait(lk);
+		w_flag--;
+		return 1;
+	}
+	void spsc_notify_r()
+	{
+		std::unique_lock<std::mutex> lk(lr);
+		r_flag++;
+		cond_r.notify_one();
+	}
+	void spsc_notify_w()
+	{
+		std::unique_lock<std::mutex> lk(lw);
+		w_flag++;
+		cond_w.notify_one();
+	}
+};
+
+// originally designed for select loop integration
+template <bool block_read, bool block_write>
+class spsc_efd_detail {
+	int efd_r, efd_w; /* eventfds used to block/notify readers/writers */
+
+    public:
+	explicit spsc_efd_detail()
+		: efd_r(eventfd(0, block_read ? 0 : EFD_NONBLOCK)), efd_w(eventfd(1, block_write ? 0 : EFD_NONBLOCK))
+	{
+	}
+
+	~spsc_efd_detail()
+	{
+		close(efd_r);
+		close(efd_w);
+	}
+
+	ssize_t spsc_check_r()
+	{
+		uint64_t efdr;
+		return read(efd_r, &efdr, sizeof(uint64_t));
+	}
+	ssize_t spsc_check_w()
+	{
+		uint64_t efdr;
+		return read(efd_w, &efdr, sizeof(uint64_t));
+	}
+	void spsc_notify_r()
+	{
+		uint64_t efdu = 1;
+		write(efd_r, &efdu, sizeof(uint64_t));
+	}
+	void spsc_notify_w()
+	{
+		uint64_t efdu = 1;
+		write(efd_w, &efdu, sizeof(uint64_t));
+	}
+	int get_r_efd()
+	{
+		return efd_r;
+	}
+	int get_w_efd()
+	{
+		return efd_w;
+	}
+};
+
+template <unsigned int SZ, typename ELEM, bool block_read, bool block_write, template <bool, bool> class T>
+class spsc : public T<block_read, block_write> {
+	static_assert(SZ > 0, "queues need a size...");
+	std::atomic<unsigned int> readptr;
+	std::atomic<unsigned int> writeptr;
+
+	ELEM buf[SZ];
+
+    public:
+	using base_t = T<block_read, block_write>;
+	using elem_t = ELEM;
+	explicit spsc() : readptr(0), writeptr(0)
+	{
+	}
+
+	~spsc()
+	{
+	}
+
+	/*! Adds element to the queue by copying the data.
+ *  \param[in] elem input buffer, must match the originally configured queue buffer size!.
+ *  \returns true if queue was not full and element was successfully pushed */
+	bool spsc_push(const ELEM *elem)
+	{
+		size_t cur_wp, cur_rp;
+		cur_wp = writeptr.load(std::memory_order_relaxed);
+		cur_rp = readptr.load(std::memory_order_acquire);
+		if ((cur_wp + 1) % SZ == cur_rp) {
+			if (block_write)
+				base_t::spsc_check_w(); /* blocks, ensures next (!) call succeeds */
+			return false;
+		}
+		buf[cur_wp] = *elem;
+		writeptr.store((cur_wp + 1) % SZ, std::memory_order_release);
+		if (block_read)
+			base_t::spsc_notify_r(); /* fine after release */
+		return true;
+	}
+
+	/*! Removes element from the queue by copying the data.
+ *  \param[in] elem output buffer, must match the originally configured queue buffer size!.
+ *  \returns true if queue was not empty and element was successfully removed */
+	bool spsc_pop(ELEM *elem)
+	{
+		size_t cur_wp, cur_rp;
+		cur_wp = writeptr.load(std::memory_order_acquire);
+		cur_rp = readptr.load(std::memory_order_relaxed);
+
+		if (cur_wp == cur_rp) /* blocks via prep_pop */
+			return false;
+
+		*elem = buf[cur_rp];
+		readptr.store((cur_rp + 1) % SZ, std::memory_order_release);
+		if (block_write)
+			base_t::spsc_notify_w();
+		return true;
+	}
+
+	/*! Reads the read-fd of the queue, which, depending on settings passed on queue creation, blocks.
+    * This function can be used to deliberately wait for a non-empty queue on the read side.
+    *  \returns result of reading the fd. */
+	ssize_t spsc_prep_pop()
+	{
+		return base_t::spsc_check_r();
+	}
+};
+
+} // namespace spsc_detail
+
+template <unsigned int SZ, typename ELEM, bool block_read, bool block_write>
+class spsc_evfd : public spsc_detail::spsc<SZ, ELEM, block_read, block_write, spsc_detail::spsc_efd_detail> {};
+template <unsigned int SZ, typename ELEM, bool block_read, bool block_write>
+class spsc_cond : public spsc_detail::spsc<SZ, ELEM, block_read, block_write, spsc_detail::spsc_cond_detail> {};
+template <unsigned int SZ, typename ELEM, bool block_read, bool block_write>
+class spsc_cond_timeout
+	: public spsc_detail::spsc<SZ, ELEM, block_read, block_write, spsc_detail::spsc_cond_timeout_detail> {};
--- a/Transceiver52M/ms/l1ctl_server.c
+++ b/Transceiver52M/ms/l1ctl_server.c
@@ -0,0 +1,275 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ * UNIX socket server for L1CTL
+ *
+ * (C) 2013 by Sylvain Munaut <tnt@246tNt.com>
+ * (C) 2016-2017 by Vadim Yanitskiy <axilirator@gmail.com>
+ * (C) 2022 by by sysmocom - s.f.m.c. GmbH <info@sysmocom.de>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <sys/un.h>
+#include <arpa/inet.h>
+#include <sys/socket.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/core/write_queue.h>
+
+#include <osmocom/bb/trxcon/logging.h>
+#include <osmocom/bb/trxcon/l1ctl_server.h>
+
+#define LOGP_CLI(cli, cat, level, fmt, args...) LOGP(cat, level, "%s" fmt, (cli)->log_prefix, ##args)
+
+static int l1ctl_client_read_cb(struct osmo_fd *ofd)
+{
+	struct l1ctl_client *client = (struct l1ctl_client *)ofd->data;
+	struct msgb *msg;
+	uint16_t len;
+	int rc;
+
+	/* Attempt to read from socket */
+	rc = read(ofd->fd, &len, L1CTL_MSG_LEN_FIELD);
+	if (rc != L1CTL_MSG_LEN_FIELD) {
+		if (rc <= 0) {
+			LOGP_CLI(client, DL1D, LOGL_NOTICE, "L1CTL connection error: read() failed (rc=%d): %s\n", rc,
+				 strerror(errno));
+		} else {
+			LOGP_CLI(client, DL1D, LOGL_NOTICE, "L1CTL connection error: short read\n");
+			rc = -EIO;
+		}
+		l1ctl_client_conn_close(client);
+		return rc;
+	}
+
+	/* Check message length */
+	len = ntohs(len);
+	if (len > L1CTL_LENGTH) {
+		LOGP_CLI(client, DL1D, LOGL_ERROR, "Length is too big: %u\n", len);
+		return -EINVAL;
+	}
+
+	/* Allocate a new msg */
+	msg = msgb_alloc_headroom(L1CTL_LENGTH + L1CTL_HEADROOM, L1CTL_HEADROOM, "l1ctl_rx_msg");
+	if (!msg) {
+		LOGP_CLI(client, DL1D, LOGL_ERROR, "Failed to allocate msg\n");
+		return -ENOMEM;
+	}
+
+	msg->l1h = msgb_put(msg, len);
+	rc = read(ofd->fd, msg->l1h, msgb_l1len(msg));
+	if (rc != len) {
+		LOGP_CLI(client, DL1D, LOGL_ERROR, "Can not read data: len=%d < rc=%d: %s\n", len, rc, strerror(errno));
+		msgb_free(msg);
+		return rc;
+	}
+
+	/* Debug print */
+	LOGP_CLI(client, DL1D, LOGL_DEBUG, "RX: '%s'\n", osmo_hexdump(msg->data, msg->len));
+
+	/* Call L1CTL handler */
+	client->server->cfg->conn_read_cb(client, msg);
+
+	return 0;
+}
+
+static int l1ctl_client_write_cb(struct osmo_fd *ofd, struct msgb *msg)
+{
+	struct l1ctl_client *client = (struct l1ctl_client *)ofd->data;
+	int len;
+
+	if (ofd->fd <= 0)
+		return -EINVAL;
+
+	len = write(ofd->fd, msg->data, msg->len);
+	if (len != msg->len) {
+		LOGP_CLI(client, DL1D, LOGL_ERROR, "Failed to write data: written (%d) < msg_len (%d)\n", len,
+			 msg->len);
+		return -1;
+	}
+
+	return 0;
+}
+
+/* Connection handler */
+static int l1ctl_server_conn_cb(struct osmo_fd *sfd, unsigned int flags)
+{
+	struct l1ctl_server *server = (struct l1ctl_server *)sfd->data;
+	struct l1ctl_client *client;
+	int rc, client_fd;
+
+	client_fd = accept(sfd->fd, NULL, NULL);
+	if (client_fd < 0) {
+		LOGP(DL1C, LOGL_ERROR,
+		     "Failed to accept() a new connection: "
+		     "%s\n",
+		     strerror(errno));
+		return client_fd;
+	}
+
+	if (server->cfg->num_clients_max > 0 /* 0 means unlimited */ &&
+	    server->num_clients >= server->cfg->num_clients_max) {
+		LOGP(DL1C, LOGL_NOTICE,
+		     "L1CTL server cannot accept more "
+		     "than %u connection(s)\n",
+		     server->cfg->num_clients_max);
+		close(client_fd);
+		return -ENOMEM;
+	}
+
+	client = talloc_zero(server, struct l1ctl_client);
+	if (client == NULL) {
+		LOGP(DL1C, LOGL_ERROR, "Failed to allocate an L1CTL client\n");
+		close(client_fd);
+		return -ENOMEM;
+	}
+
+	/* Init the client's write queue */
+	osmo_wqueue_init(&client->wq, 100);
+	INIT_LLIST_HEAD(&client->wq.bfd.list);
+
+	client->wq.write_cb = &l1ctl_client_write_cb;
+	client->wq.read_cb = &l1ctl_client_read_cb;
+	osmo_fd_setup(&client->wq.bfd, client_fd, OSMO_FD_READ, &osmo_wqueue_bfd_cb, client, 0);
+
+	/* Register the client's write queue */
+	rc = osmo_fd_register(&client->wq.bfd);
+	if (rc != 0) {
+		LOGP(DL1C, LOGL_ERROR, "Failed to register a new connection fd\n");
+		close(client->wq.bfd.fd);
+		talloc_free(client);
+		return rc;
+	}
+
+	llist_add_tail(&client->list, &server->clients);
+	client->id = server->next_client_id++;
+	client->server = server;
+	server->num_clients++;
+
+	LOGP(DL1C, LOGL_NOTICE, "L1CTL server got a new connection (id=%u)\n", client->id);
+
+	if (client->server->cfg->conn_accept_cb != NULL)
+		client->server->cfg->conn_accept_cb(client);
+
+	return 0;
+}
+
+int l1ctl_client_send(struct l1ctl_client *client, struct msgb *msg)
+{
+	uint8_t *len;
+
+	/* Debug print */
+	LOGP_CLI(client, DL1D, LOGL_DEBUG, "TX: '%s'\n", osmo_hexdump(msg->data, msg->len));
+
+	if (msg->l1h != msg->data)
+		LOGP_CLI(client, DL1D, LOGL_INFO, "Message L1 header != Message Data\n");
+
+	/* Prepend 16-bit length before sending */
+	len = msgb_push(msg, L1CTL_MSG_LEN_FIELD);
+	osmo_store16be(msg->len - L1CTL_MSG_LEN_FIELD, len);
+
+	if (osmo_wqueue_enqueue(&client->wq, msg) != 0) {
+		LOGP_CLI(client, DL1D, LOGL_ERROR, "Failed to enqueue msg!\n");
+		msgb_free(msg);
+		return -EIO;
+	}
+
+	return 0;
+}
+
+void l1ctl_client_conn_close(struct l1ctl_client *client)
+{
+	struct l1ctl_server *server = client->server;
+
+	LOGP_CLI(client, DL1C, LOGL_NOTICE, "Closing L1CTL connection\n");
+
+	if (server->cfg->conn_close_cb != NULL)
+		server->cfg->conn_close_cb(client);
+
+	/* Close connection socket */
+	osmo_fd_unregister(&client->wq.bfd);
+	close(client->wq.bfd.fd);
+	client->wq.bfd.fd = -1;
+
+	/* Clear pending messages */
+	osmo_wqueue_clear(&client->wq);
+
+	client->server->num_clients--;
+	llist_del(&client->list);
+	talloc_free(client);
+
+	/* If this was the last client, reset the client IDs generator to 0.
+	 * This way avoid assigning huge unreadable client IDs like 26545. */
+	if (llist_empty(&server->clients))
+		server->next_client_id = 0;
+}
+
+struct l1ctl_server *l1ctl_server_alloc(void *ctx, const struct l1ctl_server_cfg *cfg)
+{
+	struct l1ctl_server *server;
+	int rc;
+
+	LOGP(DL1C, LOGL_NOTICE, "Init L1CTL server (sock_path=%s)\n", cfg->sock_path);
+
+	server = talloc(ctx, struct l1ctl_server);
+	OSMO_ASSERT(server != NULL);
+
+	*server = (struct l1ctl_server){
+		.clients = LLIST_HEAD_INIT(server->clients),
+		.cfg = cfg,
+	};
+
+	/* conn_read_cb shall not be NULL */
+	OSMO_ASSERT(cfg->conn_read_cb != NULL);
+
+	/* Bind connection handler */
+	osmo_fd_setup(&server->ofd, -1, OSMO_FD_READ, &l1ctl_server_conn_cb, server, 0);
+
+	rc = osmo_sock_unix_init_ofd(&server->ofd, SOCK_STREAM, 0, cfg->sock_path, OSMO_SOCK_F_BIND);
+	if (rc < 0) {
+		LOGP(DL1C, LOGL_ERROR, "Could not create UNIX socket: %s\n", strerror(errno));
+		talloc_free(server);
+		return NULL;
+	}
+
+	return server;
+}
+
+void l1ctl_server_free(struct l1ctl_server *server)
+{
+	LOGP(DL1C, LOGL_NOTICE, "Shutdown L1CTL server\n");
+
+	/* Close all client connections */
+	while (!llist_empty(&server->clients)) {
+		struct l1ctl_client *client = llist_entry(server->clients.next, struct l1ctl_client, list);
+		l1ctl_client_conn_close(client);
+	}
+
+	/* Unbind listening socket */
+	if (server->ofd.fd != -1) {
+		osmo_fd_unregister(&server->ofd);
+		close(server->ofd.fd);
+		server->ofd.fd = -1;
+	}
+
+	talloc_free(server);
+}
--- a/Transceiver52M/ms/l1ctl_server_cb.cpp
+++ b/Transceiver52M/ms/l1ctl_server_cb.cpp
@@ -0,0 +1,71 @@
+/*
+ * (C) 2022 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved
+ *
+ * Author: Eric Wild <ewild@sysmocom.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+extern "C" {
+#include <osmocom/bb/trxcon/trxcon.h>
+#include <osmocom/bb/trxcon/trxcon_fsm.h>
+#include <osmocom/bb/trxcon/l1ctl_server.h>
+}
+#include "ms_trxcon_if.h"
+
+static struct l1ctl_server_cfg server_cfg;
+static struct l1ctl_server *server = NULL;
+
+static int l1ctl_rx_cb(struct l1ctl_client *l1c, struct msgb *msg)
+{
+	struct trxcon_inst *trxcon = (struct trxcon_inst *)l1c->priv;
+
+	return trxcon_l1ctl_receive(trxcon, msg);
+}
+
+static void l1ctl_conn_accept_cb(struct l1ctl_client *l1c)
+{
+	l1c->log_prefix = talloc_strdup(l1c, g_trxcon->log_prefix);
+	l1c->priv = g_trxcon;
+	g_trxcon->l2if = l1c;
+}
+
+static void l1ctl_conn_close_cb(struct l1ctl_client *l1c)
+{
+	struct trxcon_inst *trxcon = (struct trxcon_inst *)l1c->priv;
+
+	if (trxcon == NULL || trxcon->fi == NULL)
+		return;
+
+	osmo_fsm_inst_dispatch(trxcon->fi, TRXCON_EV_L2IF_FAILURE, NULL);
+}
+
+bool trxc_l1ctl_init(void *tallctx)
+{
+	/* Start the L1CTL server */
+	server_cfg = (struct l1ctl_server_cfg){
+		/* TODO: make path configurable */
+		.sock_path = "/tmp/osmocom_l2",	       .num_clients_max = 1,
+		.conn_read_cb = &l1ctl_rx_cb,	       .conn_accept_cb = &l1ctl_conn_accept_cb,
+		.conn_close_cb = &l1ctl_conn_close_cb,
+	};
+
+	server = l1ctl_server_alloc(tallctx, &server_cfg);
+	if (server == NULL) {
+		return false;
+	}
+	return true;
+}
--- a/Transceiver52M/ms/logging.c
+++ b/Transceiver52M/ms/logging.c
@@ -0,0 +1,98 @@
+/*
+ * OsmocomBB <-> SDR connection bridge
+ *
+ * (C) 2016-2017 by Vadim Yanitskiy <axilirator@gmail.com>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#include <osmocom/core/application.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/utils.h>
+
+#include <osmocom/bb/trxcon/trxcon.h>
+#include <osmocom/bb/trxcon/logging.h>
+
+static struct log_info_cat trxcon_log_info_cat[] = {
+	[DAPP] = {
+		.name = "DAPP",
+		.description = "Application",
+		.color = "\033[1;35m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+	[DL1C] = {
+		.name = "DL1C",
+		.description = "Layer 1 control interface",
+		.color = "\033[1;31m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+	[DL1D] = {
+		.name = "DL1D",
+		.description = "Layer 1 data",
+		.color = "\033[1;31m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+	[DTRXC] = {
+		.name = "DTRXC",
+		.description = "Transceiver control interface",
+		.color = "\033[1;33m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+	[DTRXD] = {
+		.name = "DTRXD",
+		.description = "Transceiver data interface",
+		.color = "\033[1;33m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+	[DSCH] = {
+		.name = "DSCH",
+		.description = "Scheduler management",
+		.color = "\033[1;36m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+	[DSCHD] = {
+		.name = "DSCHD",
+		.description = "Scheduler data",
+		.color = "\033[1;36m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+	[DGPRS] = {
+		.name = "DGPRS",
+		.description = "L1 GPRS (MAC layer)",
+		.color = "\033[1;36m",
+		.enabled = 1, .loglevel = LOGL_NOTICE,
+	},
+};
+
+static const struct log_info trxcon_log_info = {
+	.cat = trxcon_log_info_cat,
+	.num_cat = ARRAY_SIZE(trxcon_log_info_cat),
+};
+
+static const int trxcon_log_cfg[] = {
+	[TRXCON_LOGC_FSM] = DAPP,
+	[TRXCON_LOGC_L1C] = DL1C,
+	[TRXCON_LOGC_L1D] = DL1D,
+	[TRXCON_LOGC_SCHC] = DSCH,
+	[TRXCON_LOGC_SCHD] = DSCHD,
+	[TRXCON_LOGC_GPRS] = DGPRS,
+};
+
+void trxc_log_init(void *tallctx)
+{
+	osmo_init_logging2(tallctx, &trxcon_log_info);
+	log_target_file_switch_to_wqueue(osmo_stderr_target);
+
+	trxcon_set_log_cfg(&trxcon_log_cfg[0], ARRAY_SIZE(trxcon_log_cfg));
+}
--- a/Transceiver52M/ms/ms.cpp
+++ b/Transceiver52M/ms/ms.cpp
@@ -0,0 +1,160 @@
+
+/*
+ * (C) 2022 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved
+ *
+ * Author: Eric Wild <ewild@sysmocom.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+#include "GSMCommon.h"
+#include <atomic>
+#include <cassert>
+#include <complex>
+#include <iostream>
+#include <cstdlib>
+#include <cstdio>
+#include <thread>
+#include <fstream>
+
+#include "ms.h"
+
+extern "C" {
+#include "sch.h"
+}
+
+#include "threadsched.h"
+
+dummylog ms_trx::dummy_log;
+
+#ifdef DBGXX
+const int offsetrange = 200;
+const int offset_start = -15;
+static int offset_ctr = 0;
+#endif
+
+template <>
+std::atomic<bool> ms_trx::base::stop_lower_threads_flag(false);
+
+int ms_trx::init_dev_and_streams()
+{
+	int status = 0;
+	status = init_device(rx_bh(), tx_bh());
+	if (status < 0) {
+		std::cerr << "failed to init dev!" << std::endl;
+		return -1;
+	}
+	return status;
+}
+
+bh_fn_t ms_trx::rx_bh()
+{
+	return [this](dev_buf_t *rcd) -> int {
+		if (this->search_for_sch(rcd) == SCH_STATE::FOUND)
+			this->grab_bursts(rcd);
+		return 0;
+	};
+}
+
+bh_fn_t ms_trx::tx_bh()
+{
+	return [this](dev_buf_t *rcd) -> int {
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wunused-variable"
+		auto y = this;
+#pragma GCC diagnostic pop
+		/* nothing to do here */
+		return 0;
+	};
+}
+
+void ms_trx::start_lower_ms()
+{
+	if (stop_lower_threads_flag)
+		return;
+	auto fn = get_rx_burst_handler_fn(rx_bh());
+	lower_rx_task = spawn_worker_thread(sched_params::thread_names::RXRUN, fn, this);
+
+	usleep(1000);
+	auto fn2 = get_tx_burst_handler_fn(tx_bh());
+	lower_tx_task = spawn_worker_thread(sched_params::thread_names::TXRUN, fn2, this);
+
+	actually_enable_streams();
+}
+
+void ms_trx::set_upper_ready(bool is_ready)
+{
+	upper_is_ready = is_ready;
+}
+
+void ms_trx::stop_threads()
+{
+	std::cerr << "killing threads..." << std::endl;
+	stop_lower_threads_flag = true;
+	close_device();
+	std::cerr << "dev closed..." << std::endl;
+	pthread_join(lower_rx_task, nullptr);
+	std::cerr << "L rx dead..." << std::endl;
+	pthread_join(lower_tx_task, nullptr);
+	std::cerr << "L tx dead..." << std::endl;
+}
+
+void ms_trx::submit_burst(blade_sample_type *buffer, int len, GSM::Time target)
+{
+	int64_t now_ts;
+	GSM::Time now_time;
+	target.incTN(3); // ul dl offset
+	int target_fn = target.FN();
+	int target_tn = target.TN();
+	timekeeper.get_both(&now_time, &now_ts);
+
+	auto diff_fn = GSM::FNDelta(target_fn, now_time.FN());
+	int diff_tn = (target_tn - (int)now_time.TN()) % 8;
+	auto tosend = GSM::Time(diff_fn, 0);
+
+	if (diff_tn > 0)
+		tosend.incTN(diff_tn);
+	else
+		tosend.decTN(-diff_tn);
+
+	// in theory fn equal and tn+3 equal is also a problem...
+	if (diff_fn < 0 || (diff_fn == 0 && (target_tn-now_time.TN() < 3))) {
+		std::cerr << "## TX too late?! fn DIFF:" << diff_fn << " tn LOCAL: " << now_time.TN()
+			  << " tn OTHER: " << target_tn << std::endl;
+		return;
+	}
+
+	int64_t send_ts = now_ts + tosend.FN() * 8 * ONE_TS_BURST_LEN + tosend.TN() * ONE_TS_BURST_LEN - timing_advance;
+#ifdef DBGXX
+	auto check = now_time + tosend;
+	std::cerr << "## fn DIFF: " << diff_fn << " ## tn DIFF: " << diff_tn << " tn LOCAL/OTHER: " << now_time.TN()
+		  << "/" << target_tn << " tndiff" << diff_tn << " tosend:" << tosend.FN() << ":" << tosend.TN()
+		  << " check: " << check.FN() << ":" << check.TN() << " target: " << target.FN() << ":" << target.TN()
+		  << " ts now: " << now_ts << " target ts:" << send_ts << std::endl;
+#endif
+#if 0
+	auto check = now_time + tosend;
+	unsigned int pad = 4 * 4;
+	blade_sample_type buf2[len + pad];
+	std::fill(buf2, buf2 + pad, 0);
+	memcpy(&buf2[pad], buffer, len * sizeof(blade_sample_type));
+
+	assert(target.FN() == check.FN());
+	assert(target.TN() == check.TN());
+	submit_burst_ts(buf2, len + pad, send_ts - pad);
+#else
+	submit_burst_ts(buffer, len, send_ts);
+#endif
+}
--- a/Transceiver52M/ms/ms.h
+++ b/Transceiver52M/ms/ms.h
@@ -0,0 +1,301 @@
+#pragma once
+/*
+ * (C) 2022 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved
+ *
+ * Author: Eric Wild <ewild@sysmocom.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <atomic>
+#include <cassert>
+#include <complex>
+#include <cstdint>
+#include <mutex>
+#include <iostream>
+// #include <thread>
+
+#if defined(BUILDBLADE)
+#include "bladerf_specific.h"
+#define BASET blade_hw<ms_trx>
+#elif defined(BUILDUHD)
+#include "uhd_specific.h"
+#define BASET uhd_hw<ms_trx>
+#else
+#error wat? no device..
+#endif
+
+#include "Complex.h"
+#include "GSMCommon.h"
+#include "itrq.h"
+#include "threadpool.h"
+#include "threadsched.h"
+
+const unsigned int ONE_TS_BURST_LEN = (3 + 58 + 26 + 58 + 3 + 8.25) * 4 /*sps*/;
+const unsigned int SCH_LEN_SPS = (ONE_TS_BURST_LEN * 8 /*ts*/ * 12 /*frames*/);
+
+template <typename T>
+void clamp_array(T *start2, unsigned int len, T max)
+{
+	for (unsigned int i = 0; i < len; i++) {
+		const T t1 = start2[i] < -max ? -max : start2[i];
+		const T t2 = t1 > max ? max : t1;
+		start2[i] = t2;
+	}
+}
+
+namespace cvt_internal
+{
+
+template <typename SRC_T, typename ST>
+void convert_and_scale_i(float *dst, const SRC_T *src, unsigned int src_len, ST scale)
+{
+	for (unsigned int i = 0; i < src_len; i++)
+		dst[i] = static_cast<float>(src[i]) * scale;
+}
+
+template <typename DST_T, typename ST>
+void convert_and_scale_i(DST_T *dst, const float *src, unsigned int src_len, ST scale)
+{
+	for (unsigned int i = 0; i < src_len; i++)
+		dst[i] = static_cast<DST_T>(src[i] * scale);
+}
+
+template <typename ST>
+void convert_and_scale_i(float *dst, const float *src, unsigned int src_len, ST scale)
+{
+	for (unsigned int i = 0; i < src_len; i++)
+		dst[i] = src[i] * scale;
+}
+
+template <typename T>
+struct is_complex : std::false_type {
+	using baset = T;
+	static const unsigned int len_mul = 1;
+};
+
+template <typename T>
+struct is_complex<std::complex<T>> : std::true_type {
+	using baset = typename std::complex<T>::value_type;
+	static const unsigned int len_mul = 2;
+};
+
+template <typename T>
+struct is_complex<Complex<T>> : std::true_type {
+	using baset = typename Complex<T>::value_type;
+	static const unsigned int len_mul = 2;
+};
+
+} // namespace cvt_internal
+
+template <typename DST_T, typename SRC_T, typename ST>
+void convert_and_scale(DST_T *dst, const SRC_T *src, unsigned int src_len, ST scale)
+{
+	using vd = typename cvt_internal::is_complex<DST_T>::baset;
+	using vs = typename cvt_internal::is_complex<SRC_T>::baset;
+	return cvt_internal::convert_and_scale_i((vd *)dst, (vs *)src, src_len, scale);
+}
+
+template <typename array_t>
+float normed_abs_sum(array_t *src, int len)
+{
+	using vd = typename cvt_internal::is_complex<array_t>::baset;
+	auto len_mul = cvt_internal::is_complex<array_t>::len_mul;
+	auto ptr = reinterpret_cast<const vd *>(src);
+	float sum = 0;
+	for (unsigned int i = 0; i < len * len_mul; i++)
+		sum += std::abs(ptr[i]);
+	sum /= len * len_mul;
+	return sum;
+}
+
+struct one_burst {
+	one_burst()
+	{
+	}
+	GSM::Time gsmts;
+	union {
+		blade_sample_type burst[ONE_TS_BURST_LEN];
+		char sch_bits[148];
+	};
+};
+
+using rx_queue_t = spsc_cond_timeout<4, one_burst, true, false>;
+
+enum class SCH_STATE { SEARCHING, FOUND };
+
+class dummylog : private std::streambuf {
+	std::ostream null_stream;
+
+    public:
+	dummylog() : null_stream(this){};
+	~dummylog() override{};
+	std::ostream &operator()()
+	{
+		return null_stream;
+	}
+	int overflow(int c) override
+	{
+		return c;
+	}
+};
+
+// keeps relationship between gsm time and (continuously adjusted) ts
+class time_keeper {
+	GSM::Time global_time_keeper;
+	int64_t global_ts_keeper;
+	std::mutex m;
+
+    public:
+	time_keeper() : global_time_keeper(0), global_ts_keeper(0)
+	{
+	}
+
+	void set(GSM::Time t, int64_t ts)
+	{
+		std::lock_guard<std::mutex> g(m);
+		global_time_keeper = t;
+		global_ts_keeper = ts;
+	}
+	void inc_both()
+	{
+		std::lock_guard<std::mutex> g(m);
+		global_time_keeper.incTN(1);
+		global_ts_keeper += ONE_TS_BURST_LEN;
+	}
+	void inc_and_update(int64_t new_ts)
+	{
+		std::lock_guard<std::mutex> g(m);
+		global_time_keeper.incTN(1);
+		global_ts_keeper = new_ts;
+		// std::cerr << "u " << new_ts << std::endl;
+	}
+	void inc_and_update_safe(int64_t new_ts)
+	{
+		std::lock_guard<std::mutex> g(m);
+		auto diff = new_ts - global_ts_keeper;
+		assert(diff < 1.5 * ONE_TS_BURST_LEN);
+		assert(diff > 0.5 * ONE_TS_BURST_LEN);
+		global_time_keeper.incTN(1);
+		global_ts_keeper = new_ts;
+		// std::cerr << "s " << new_ts << std::endl;
+	}
+	void dec_by_one()
+	{
+		std::lock_guard<std::mutex> g(m);
+		global_time_keeper.decTN(1);
+		global_ts_keeper -= ONE_TS_BURST_LEN;
+	}
+	auto get_ts()
+	{
+		std::lock_guard<std::mutex> g(m);
+		return global_ts_keeper;
+	}
+	auto gsmtime()
+	{
+		std::lock_guard<std::mutex> g(m);
+		return global_time_keeper;
+	}
+	void get_both(GSM::Time *t, int64_t *ts)
+	{
+		std::lock_guard<std::mutex> g(m);
+		*t = global_time_keeper;
+		*ts = global_ts_keeper;
+	}
+};
+
+using ts_hitter_q_t = spsc_cond<64, GSM::Time, true, false>;
+
+// used to globally initialize the sched/hw information
+struct sched_hw_info {
+	int hw_cpus;
+	sched_params::target hw_target;
+
+	sched_hw_info()
+	{
+		hw_cpus = std::thread::hardware_concurrency();
+		hw_target = hw_cpus > 4 ? sched_params::target::ODROID : sched_params::target::PI4;
+		set_sched_target(hw_target);
+		std::cerr << "scheduling for: " << (hw_cpus > 4 ? "odroid" : "pi4") << std::endl;
+	}
+};
+
+struct ms_trx : public BASET, public sched_hw_info {
+	using base = BASET;
+	static dummylog dummy_log;
+	unsigned int mTSC;
+	unsigned int mBSIC;
+	int timing_advance;
+	bool do_auto_gain;
+
+	pthread_t lower_rx_task;
+	pthread_t lower_tx_task;
+
+	// provides bursts to upper rx thread
+	rx_queue_t rxqueue;
+
+	blade_sample_type *first_sch_buf;
+	blade_sample_type *burst_copy_buffer;
+
+	uint64_t first_sch_buf_rcv_ts;
+	std::atomic<bool> rcv_done;
+	std::atomic<bool> sch_thread_done;
+
+	int64_t temp_ts_corr_offset = 0;
+	int64_t first_sch_ts_start = -1;
+
+	time_keeper timekeeper;
+	single_thread_pool worker_thread; // uses base class sched target hw info
+
+	void start_lower_ms();
+	std::atomic<bool> upper_is_ready;
+	void set_upper_ready(bool is_ready);
+
+	bool handle_sch_or_nb();
+	bool handle_sch(bool first = false);
+	bool decode_sch(char *bits, bool update_global_clock);
+	SCH_STATE search_for_sch(dev_buf_t *rcd);
+	void grab_bursts(dev_buf_t *rcd);
+
+	int init_dev_and_streams();
+	void stop_threads();
+	void *rx_cb(ms_trx *t);
+	void *tx_cb();
+	void maybe_update_gain(one_burst &brst);
+
+	ms_trx()
+		: mTSC(0), mBSIC(0), timing_advance(0), do_auto_gain(false), rxqueue(),
+		  first_sch_buf(new blade_sample_type[SCH_LEN_SPS]),
+		  burst_copy_buffer(new blade_sample_type[ONE_TS_BURST_LEN]), first_sch_buf_rcv_ts(0),
+		  rcv_done{ false }, sch_thread_done{ false }, upper_is_ready(false)
+	{
+	}
+
+	virtual ~ms_trx()
+	{
+		delete[] burst_copy_buffer;
+		delete[] first_sch_buf;
+	}
+	bh_fn_t rx_bh();
+	bh_fn_t tx_bh();
+
+	void submit_burst(blade_sample_type *buffer, int len, GSM::Time);
+	void set_ta(int val)
+	{
+		assert(val > -127 && val < 128);
+		timing_advance = val * 4;
+	}
+};
--- a/Transceiver52M/ms/ms_rx_lower.cpp
+++ b/Transceiver52M/ms/ms_rx_lower.cpp
@@ -0,0 +1,420 @@
+/*
+ * (C) 2022 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved
+ *
+ * Author: Eric Wild <ewild@sysmocom.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "sigProcLib.h"
+#include "signalVector.h"
+#include <atomic>
+#include <cassert>
+#include <complex>
+#include <iostream>
+#include <future>
+
+#include "ms.h"
+#include "grgsm_vitac/grgsm_vitac.h"
+
+#include "threadpool.h"
+
+extern "C" {
+#include "sch.h"
+}
+
+#ifdef LOG
+#undef LOG
+#endif
+
+#if !defined(NODAMNLOG)
+#define DBGLG(...) ms_trx::dummy_log()
+#else
+#define DBGLG(...) std::cerr
+#endif
+
+#if !defined(NODAMNLOG)
+#define DBGLG2(...) ms_trx::dummy_log()
+#else
+#define DBGLG2(...) std::cerr
+#endif
+
+#define PRINT_Q_OVERFLOW
+
+bool ms_trx::decode_sch(char *bits, bool update_global_clock)
+{
+	int fn;
+	struct sch_info sch;
+	ubit_t info[GSM_SCH_INFO_LEN];
+	sbit_t data[GSM_SCH_CODED_LEN];
+
+	memcpy(&data[0], &bits[3], 39);
+	memcpy(&data[39], &bits[106], 39);
+
+	if (!gsm_sch_decode(info, data)) {
+		gsm_sch_parse(info, &sch);
+
+		if (update_global_clock) {
+			DBGLG() << "SCH : Decoded values" << std::endl;
+			DBGLG() << "    BSIC: " << sch.bsic << std::endl;
+			DBGLG() << "    TSC: " << (sch.bsic & 0x7) << std::endl;
+			DBGLG() << "    T1  : " << sch.t1 << std::endl;
+			DBGLG() << "    T2  : " << sch.t2 << std::endl;
+			DBGLG() << "    T3p : " << sch.t3p << std::endl;
+			DBGLG() << "    FN  : " << gsm_sch_to_fn(&sch) << std::endl;
+		}
+
+		fn = gsm_sch_to_fn(&sch);
+		if (fn < 0) { // how? wh?
+			DBGLG() << "SCH : Failed to convert FN " << std::endl;
+			return false;
+		}
+
+		if (update_global_clock) {
+			mBSIC = sch.bsic;
+			mTSC = sch.bsic & 0x7;
+			timekeeper.set(fn, 0);
+			// global_time_keeper.FN(fn);
+			// global_time_keeper.TN(0);
+		}
+
+		return true;
+	}
+	return false;
+}
+
+void ms_trx::maybe_update_gain(one_burst &brst)
+{
+	static_assert((sizeof(brst.burst) / sizeof(brst.burst[0])) == ONE_TS_BURST_LEN, "wtf, buffer size mismatch?");
+	const int avgburst_num = 8 * 20; // ~ 50*4.5ms = 90ms?
+	static_assert(avgburst_num * 577 > (50 * 1000), "can't update faster then blade wait time?");
+	const unsigned int rx_max_cutoff = (rxFullScale * 2) / 3;
+	static int gain_check = 0;
+	static float runmean = 0;
+	float sum = normed_abs_sum(&brst.burst[0], ONE_TS_BURST_LEN);
+	runmean = gain_check ? (runmean * (gain_check + 2) - 1 + sum) / (gain_check + 2) : sum;
+
+	if (gain_check == avgburst_num - 1) {
+		DBGLG2() << "\x1B[32m #RXG \033[0m" << rxgain << " " << runmean << " " << sum << std::endl;
+		auto gainoffset = runmean < (rxFullScale / 4 ? 4 : 2);
+		gainoffset = runmean < (rxFullScale / 2 ? 2 : 1);
+		float newgain = runmean < rx_max_cutoff ? rxgain + gainoffset : rxgain - gainoffset;
+		// FIXME: gian cutoff
+		if (newgain != rxgain && newgain <= 60) {
+			auto gain_fun = [this, newgain] { setRxGain(newgain); };
+			worker_thread.add_task(gain_fun);
+		}
+
+		runmean = 0;
+	}
+	gain_check = (gain_check + 1) % avgburst_num;
+}
+
+static char sch_demod_bits[148];
+
+bool ms_trx::handle_sch_or_nb()
+{
+	one_burst brst;
+	const auto current_gsm_time = timekeeper.gsmtime();
+	const auto is_sch = gsm_sch_check_ts(current_gsm_time.TN(), current_gsm_time.FN());
+
+	//either pass burst to upper layer for demod, OR pass demodded SCH to upper layer so we don't waste time processing it twice
+	brst.gsmts = current_gsm_time;
+
+	if (!is_sch) {
+		memcpy(brst.burst, burst_copy_buffer, sizeof(blade_sample_type) * ONE_TS_BURST_LEN);
+	} else {
+		handle_sch(false);
+		memcpy(brst.sch_bits, sch_demod_bits, sizeof(sch_demod_bits));
+	}
+
+	while (upper_is_ready && !rxqueue.spsc_push(&brst))
+		;
+
+	if (do_auto_gain)
+		maybe_update_gain(brst);
+
+	return false;
+}
+
+static float sch_acq_buffer[SCH_LEN_SPS * 2];
+
+bool ms_trx::handle_sch(bool is_first_sch_acq)
+{
+	auto current_gsm_time = timekeeper.gsmtime();
+	const auto buf_len = is_first_sch_acq ? SCH_LEN_SPS : ONE_TS_BURST_LEN;
+	const auto which_in_buffer = is_first_sch_acq ? first_sch_buf : burst_copy_buffer;
+	memset((void *)&sch_acq_buffer[0], 0, sizeof(sch_acq_buffer));
+#if 1
+	const auto which_out_buffer = is_first_sch_acq ? sch_acq_buffer : &sch_acq_buffer[40 * 2];
+	const auto ss = reinterpret_cast<std::complex<float> *>(which_out_buffer);
+	std::complex<float> channel_imp_resp[CHAN_IMP_RESP_LENGTH * d_OSR];
+	int start;
+	convert_and_scale(which_out_buffer, which_in_buffer, buf_len * 2, 1.f / float(rxFullScale));
+	if (is_first_sch_acq) {
+		float max_corr = 0;
+		start = get_sch_buffer_chan_imp_resp(ss, &channel_imp_resp[0], buf_len, &max_corr);
+	} else {
+		start = get_sch_chan_imp_resp(ss, &channel_imp_resp[0]);
+		start = start < 39 ? start : 39;
+		start = start > -39 ? start : -39;
+	}
+	detect_burst_nb(&ss[start], &channel_imp_resp[0], 0, sch_demod_bits);
+
+	auto sch_decode_success = decode_sch(sch_demod_bits, is_first_sch_acq);
+#if 0
+	auto burst = new signalVector(buf_len, 50);
+	const auto corr_type = is_first_sch_acq ? sch_detect_type::SCH_DETECT_BUFFER : sch_detect_type::SCH_DETECT_FULL;
+	struct estim_burst_params ebp;
+
+	// scale like uhd, +-2k -> +-32k
+	convert_and_scale(burst->begin(), which_in_buffer, buf_len * 2, SAMPLE_SCALE_FACTOR);
+
+	auto rv = detectSCHBurst(*burst, 4, 4, corr_type, &ebp);
+
+	int howmuchdelay = ebp.toa * 4;
+	std::cerr << "ooffs: " << howmuchdelay << " " << std::endl;
+	std::cerr << "voffs: " << start << " " << sch_decode_success << std::endl;
+#endif
+	if (sch_decode_success) {
+		const auto ts_offset_symb = 4;
+		if (is_first_sch_acq) {
+			// update ts to first sample in sch buffer, to allow delay calc for current ts
+			first_sch_ts_start = first_sch_buf_rcv_ts + start - (ts_offset_symb * 4) - 1;
+		} else if (abs(start) > 1) {
+			// continuous sch tracking, only update if off too much
+			temp_ts_corr_offset += -start;
+			std::cerr << "offs: " << start << " " << temp_ts_corr_offset << std::endl;
+		}
+
+		return true;
+	} else {
+		DBGLG2() << "L SCH : \x1B[31m decode fail \033[0m @ toa:" << start << " " << current_gsm_time.FN()
+			 << ":" << current_gsm_time.TN() << std::endl;
+	}
+#else
+	const auto ts_offset_symb = 4;
+	auto burst = new signalVector(buf_len, 50);
+	const auto corr_type = is_first_sch_acq ? sch_detect_type::SCH_DETECT_BUFFER : sch_detect_type::SCH_DETECT_FULL;
+	struct estim_burst_params ebp;
+
+	// scale like uhd, +-2k -> +-32k
+	convert_and_scale(burst->begin(), which_in_buffer, buf_len * 2, SAMPLE_SCALE_FACTOR);
+
+	auto rv = detectSCHBurst(*burst, 4, 4, corr_type, &ebp);
+
+	int howmuchdelay = ebp.toa * 4;
+
+	if (!rv) {
+		delete burst;
+		DBGLG() << "SCH : \x1B[31m detect fail \033[0m NOOOOOOOOOOOOOOOOOO toa:" << ebp.toa << " "
+			<< current_gsm_time.FN() << ":" << current_gsm_time.TN() << std::endl;
+		return false;
+	}
+
+	SoftVector *bits;
+	if (is_first_sch_acq) {
+		// can't be legit with a buf size spanning _at least_ one SCH but delay that implies partial sch burst
+		if (howmuchdelay < 0 || (buf_len - howmuchdelay) < ONE_TS_BURST_LEN) {
+			delete burst;
+			return false;
+		}
+
+		struct estim_burst_params ebp2;
+		// auto sch_chunk = new signalVector(ONE_TS_BURST_LEN, 50);
+		// auto sch_chunk_start = sch_chunk->begin();
+		// memcpy(sch_chunk_start, sch_buf_f.data() + howmuchdelay, sizeof(std::complex<float>) * ONE_TS_BURST_LEN);
+
+		auto delay = delayVector(burst, NULL, -howmuchdelay);
+
+		scaleVector(*delay, (complex)1.0 / ebp.amp);
+
+		auto rv2 = detectSCHBurst(*delay, 4, 4, sch_detect_type::SCH_DETECT_FULL, &ebp2);
+		DBGLG() << "FIRST SCH : " << (rv2 ? "yes " : "   ") << "Timing offset     " << ebp2.toa << " symbols"
+			<< std::endl;
+
+		bits = demodAnyBurst(*delay, SCH, 4, &ebp2);
+		delete delay;
+	} else {
+		bits = demodAnyBurst(*burst, SCH, 4, &ebp);
+	}
+
+	delete burst;
+
+	// clamp to +-1.5 because +-127 softbits scaled by 64 after -0.5 can be at most +-1.5
+	clamp_array(bits->begin(), 148, 1.5f);
+
+	float_to_sbit(&bits->begin()[0], (signed char *)&sch_demod_bits[0], 62, 148);
+	// float_to_sbit(&bits->begin()[106], &data[39], 62, 39);
+
+	if (decode_sch((char *)sch_demod_bits, is_first_sch_acq)) {
+		auto current_gsm_time_updated = timekeeper.gsmtime();
+		if (is_first_sch_acq) {
+			// update ts to first sample in sch buffer, to allow delay calc for current ts
+			first_sch_ts_start = first_sch_buf_rcv_ts + howmuchdelay - (ts_offset_symb * 4);
+		} else {
+			// continuous sch tracking, only update if off too much
+			auto diff = [](float x, float y) { return x > y ? x - y : y - x; };
+
+			auto d = diff(ebp.toa, ts_offset_symb);
+			if (abs(d) > 0.3) {
+				if (ebp.toa < ts_offset_symb)
+					ebp.toa = d;
+				else
+					ebp.toa = -d;
+				temp_ts_corr_offset += ebp.toa * 4;
+
+				DBGLG() << "offs: " << ebp.toa << " " << temp_ts_corr_offset << std::endl;
+			}
+		}
+
+		auto a = gsm_sch_check_fn(current_gsm_time_updated.FN() - 1);
+		auto b = gsm_sch_check_fn(current_gsm_time_updated.FN());
+		auto c = gsm_sch_check_fn(current_gsm_time_updated.FN() + 1);
+		DBGLG() << "L SCH : Timing offset     " << rv << " " << ebp.toa << " " << a << b << c << "fn "
+			<< current_gsm_time_updated.FN() << ":" << current_gsm_time_updated.TN() << std::endl;
+
+		delete bits;
+		return true;
+	} else {
+		DBGLG2() << "L SCH : \x1B[31m decode fail \033[0m @ toa:" << ebp.toa << " " << current_gsm_time.FN()
+			 << ":" << current_gsm_time.TN() << std::endl;
+	}
+
+	delete bits;
+#endif
+	return false;
+}
+
+/*
+accumulates a full big buffer consisting of 8*12 timeslots, then:
+either
+1) adjusts gain if necessary and starts over
+2) searches and finds SCH and is done
+*/
+SCH_STATE ms_trx::search_for_sch(dev_buf_t *rcd)
+{
+	static unsigned int sch_pos = 0;
+	auto to_copy = SCH_LEN_SPS - sch_pos;
+
+	if (sch_thread_done)
+		return SCH_STATE::FOUND;
+
+	if (rcv_done)
+		return SCH_STATE::SEARCHING;
+
+	if (sch_pos == 0) // keep first ts for time delta calc
+		first_sch_buf_rcv_ts = rcd->get_first_ts();
+
+	if (to_copy) {
+		auto spsmax = rcd->actual_samples_per_buffer();
+		if (to_copy > (unsigned int)spsmax)
+			sch_pos += rcd->readall(first_sch_buf + sch_pos);
+		else
+			sch_pos += rcd->read_n(first_sch_buf + sch_pos, 0, to_copy);
+	} else { // (!to_copy)
+		sch_pos = 0;
+		rcv_done = true;
+		auto sch_search_fun = [this] {
+			const auto target_val = rxFullScale / 8;
+			float sum = normed_abs_sum(first_sch_buf, SCH_LEN_SPS);
+
+			//FIXME: arbitrary value, gain cutoff
+			if (sum > target_val || rxgain >= 60) // enough ?
+				sch_thread_done = this->handle_sch(true);
+			else {
+				std::cerr << "\x1B[32m #RXG \033[0m gain " << rxgain << " -> " << rxgain + 4
+					  << " sample avg:" << sum << " target: >=" << target_val << std::endl;
+				setRxGain(rxgain + 4);
+			}
+
+			if (!sch_thread_done)
+				rcv_done = false; // retry!
+		};
+		worker_thread.add_task(sch_search_fun);
+	}
+	return SCH_STATE::SEARCHING;
+}
+
+void ms_trx::grab_bursts(dev_buf_t *rcd)
+{
+	// partial burst samples read from the last buffer
+	static int partial_rdofs = 0;
+	static bool first_call = true;
+	int to_skip = 0;
+
+	// round up to next burst by calculating the time between sch detection and now
+	if (first_call) {
+		const auto next_burst_start = rcd->get_first_ts() - first_sch_ts_start;
+		const auto fullts = next_burst_start / ONE_TS_BURST_LEN;
+		const auto fracts = next_burst_start % ONE_TS_BURST_LEN;
+		to_skip = ONE_TS_BURST_LEN - fracts;
+
+		for (unsigned int i = 0; i < fullts; i++)
+			timekeeper.inc_and_update(first_sch_ts_start + i * ONE_TS_BURST_LEN);
+
+		if (fracts)
+			timekeeper.inc_both();
+		// timekeeper.inc_and_update(first_sch_ts_start + 1 * ONE_TS_BURST_LEN);
+
+		timekeeper.dec_by_one(); // oops, off by one?
+
+		timekeeper.set(timekeeper.gsmtime(), rcd->get_first_ts() - ONE_TS_BURST_LEN + to_skip);
+
+		DBGLG() << "this ts: " << rcd->get_first_ts() << " diff full TN: " << fullts << " frac TN: " << fracts
+			<< " GSM now: " << timekeeper.gsmtime().FN() << ":" << timekeeper.gsmtime().TN() << " is sch? "
+			<< gsm_sch_check_fn(timekeeper.gsmtime().FN()) << std::endl;
+		first_call = false;
+	}
+
+	if (partial_rdofs) {
+		auto first_remaining = ONE_TS_BURST_LEN - partial_rdofs;
+		auto rd = rcd->read_n(burst_copy_buffer + partial_rdofs, 0, first_remaining);
+		if (rd != (int)first_remaining) {
+			partial_rdofs += rd;
+			return;
+		}
+
+		timekeeper.inc_and_update_safe(rcd->get_first_ts() - partial_rdofs);
+		handle_sch_or_nb();
+		to_skip = first_remaining;
+	}
+
+	// apply sample rate slippage compensation
+	to_skip -= temp_ts_corr_offset;
+
+	// FIXME: happens rarely, read_n start -1 blows up
+	// this is fine: will just be corrected one buffer later
+	if (to_skip < 0)
+		to_skip = 0;
+	else
+		temp_ts_corr_offset = 0;
+
+	const auto left_after_burst = rcd->actual_samples_per_buffer() - to_skip;
+
+	const int full = left_after_burst / ONE_TS_BURST_LEN;
+	const int frac = left_after_burst % ONE_TS_BURST_LEN;
+
+	for (int i = 0; i < full; i++) {
+		rcd->read_n(burst_copy_buffer, to_skip + i * ONE_TS_BURST_LEN, ONE_TS_BURST_LEN);
+		timekeeper.inc_and_update_safe(rcd->get_first_ts() + to_skip + i * ONE_TS_BURST_LEN);
+		handle_sch_or_nb();
+	}
+
+	if (frac)
+		rcd->read_n(burst_copy_buffer, to_skip + full * ONE_TS_BURST_LEN, frac);
+	partial_rdofs = frac;
+}
--- a/Transceiver52M/ms/ms_trxcon_if.cpp
+++ b/Transceiver52M/ms/ms_trxcon_if.cpp
@@ -0,0 +1,78 @@
+/*
+ * (C) 2023 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved
+ *
+ * Author: Eric Wild <ewild@sysmocom.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <atomic>
+#include "ms_trxcon_if.h"
+extern "C" {
+#include <osmocom/bb/trxcon/trxcon.h>
+#include <osmocom/bb/trxcon/l1ctl_server.h>
+#include <osmocom/core/panic.h>
+}
+
+extern tx_queue_t txq;
+extern cmd_queue_t cmdq_to_phy;
+extern cmdr_queue_t cmdq_from_phy;
+extern std::atomic<bool> g_exit_flag;
+// trxcon C call(back) if
+extern "C" {
+int trxcon_phyif_handle_burst_req(void *phyif, const struct trxcon_phyif_burst_req *br)
+{
+	if (br->burst_len == 0) // dummy/nope
+		return 0;
+	OSMO_ASSERT(br->burst != 0);
+
+	internal_q_tx_buf b(br);
+	if (!g_exit_flag)
+		txq.spsc_push(&b);
+	return 0;
+}
+
+int trxcon_phyif_handle_cmd(void *phyif, const struct trxcon_phyif_cmd *cmd)
+{
+#ifdef TXDEBUG
+	DBGLG() << "TOP C: " << cmd2str(cmd->type) << std::endl;
+#endif
+	if (!g_exit_flag)
+		cmdq_to_phy.spsc_push(cmd);
+	// q for resp polling happens in main loop
+	return 0;
+}
+
+void trxcon_phyif_close(void *phyif)
+{
+}
+
+void trxcon_l1ctl_close(struct trxcon_inst *trxcon)
+{
+	/* Avoid use-after-free: both *fi and *trxcon are children of
+	 * the L2IF (L1CTL connection), so we need to re-parent *fi
+	 * to NULL before calling l1ctl_client_conn_close(). */
+	talloc_steal(NULL, trxcon->fi);
+	l1ctl_client_conn_close((struct l1ctl_client *)trxcon->l2if);
+}
+
+int trxcon_l1ctl_send(struct trxcon_inst *trxcon, struct msgb *msg)
+{
+	struct l1ctl_client *l1c = (struct l1ctl_client *)trxcon->l2if;
+
+	return l1ctl_client_send(l1c, msg);
+}
+}
--- a/Transceiver52M/ms/ms_trxcon_if.h
+++ b/Transceiver52M/ms/ms_trxcon_if.h
@@ -0,0 +1,42 @@
+#pragma once
+/*
+ * (C) 2023 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
+ * All Rights Reserved
+ *
+ * Author: Eric Wild <ewild@sysmocom.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "ms.h"
+extern "C" {
+#include <osmocom/bb/trxcon/phyif.h>
+}
+
+extern struct trxcon_inst *g_trxcon;
+struct internal_q_tx_buf {
+	trxcon_phyif_burst_req r;
+	uint8_t buf[148];
+	internal_q_tx_buf() = default;
+	internal_q_tx_buf(const internal_q_tx_buf &) = delete;
+	internal_q_tx_buf &operator=(const internal_q_tx_buf &) = default;
+	internal_q_tx_buf(const struct trxcon_phyif_burst_req *br) : r(*br)
+	{
+		memcpy(buf, (void *)br->burst, br->burst_len);
+	}
+};
+using tx_queue_t = spsc_cond<8 * 1, internal_q_tx_buf, true, false>;
+using cmd_queue_t = spsc_cond_timeout<8 * 1, trxcon_phyif_cmd, true, false>;
+using cmdr_queue_t = spsc_cond<8 * 1, trxcon_phyif_rsp, false, false>;
--- a/Show More
+++ b/Show More