diff --git a/include/openbsc/abis_nm.h b/include/openbsc/abis_nm.h
index af5ade0..1ed4cce 100644
--- a/include/openbsc/abis_nm.h
+++ b/include/openbsc/abis_nm.h
@@ -171,6 +171,9 @@
 	NM_MT_SET_ALARM_THRES,
 	NM_MT_SET_ALARM_THRES_ACK,
 	NM_MT_SET_ALARM_THRES_NACK,
+
+	NM_MT_IPACC_RESTART		= 0x87,
+	NM_MT_IPACC_RESTART_ACK,
 };
 
 enum abis_nm_msgtype_bs11 {
@@ -212,8 +215,12 @@
 	NM_MT_IPACC_RSL_CONNECT		= 0xe0,
 	NM_MT_IPACC_RSL_CONNECT_ACK,
 	NM_MT_IPACC_RSL_CONNECT_NACK,
-	NM_MT_IPACC_RSL_SET_NVATTR	= 0xef,
-	NM_MT_IPACC_RSL_SET_NVATTR_ACK	= 0xff,
+	NM_MT_IPACC_SET_NVATTR		= 0xef,
+	NM_MT_IPACC_SET_NVATTR_ACK,
+	NM_MT_IPACC_SET_NVATTR_NACK,
+	NM_MT_IPACC_GET_NVATTR		= 0xf2,
+	NM_MT_IPACC_GET_NVATTR_ACK,
+	NM_MT_IPACC_GET_NVATTR_NACK,
 };
 
 /* Section 9.2: Object Class */
@@ -337,7 +344,11 @@
 
 	NM_ATT_IPACC_RSL_BSC_IP		= 0x80,
 	NM_ATT_IPACC_RSL_BSC_PORT	= 0x81,
-	NM_ATT_IPACC_PRIM_OML_IP	= 0x88,
+	NM_ATT_IPACC_LOCATION		= 0x8e,		/* string describing location */
+	NM_ATT_IPACC_UNIT_ID		= 0x91,
+	NM_ATT_IPACC_UNIT_NAME		= 0x93,		/* default: nbts-<mac-as-string> */
+	NM_ATT_IPACC_PRIM_OML_IP	= 0x95,
+	NM_ATT_IPACC_SEC_OML_IP		= 0x96,
 
 	NM_ATT_BS11_RF_RES_IND_PER	= 0x8f,
 	
@@ -570,6 +581,9 @@
 			 u_int8_t obj_class, u_int8_t bts_nr,
 			 u_int8_t trx_nr, u_int8_t ts_nr,
 			 u_int8_t *attr, int attr_len);
+int abis_nm_ipaccess_set_nvattr(struct gsm_bts *bts, u_int8_t *attr,
+				int attr_len);
+int abis_nm_ipaccess_restart(struct gsm_bts *bts);
 
 /* Functions calling into other code parts */
 enum nm_evt {
diff --git a/src/abis_nm.c b/src/abis_nm.c
index 6ca1792..cee704d 100644
--- a/src/abis_nm.c
+++ b/src/abis_nm.c
@@ -2010,12 +2010,14 @@
 		return -EINVAL;
 	}
 
-	foh = (struct abis_om_fom_hdr *) oh->data + 1 + idstrlen;
+	foh = (struct abis_om_fom_hdr *) (oh->data + 1 + idstrlen);
 	abis_nm_tlv_parse(&tp, foh->data, oh->length-sizeof(*foh));
 
+	DEBUGP(DNM, "IPACCESS(0x%02x): ", foh->msg_type);
+
 	switch (foh->msg_type) {
 	case NM_MT_IPACC_RSL_CONNECT_ACK:
-		DEBUGP(DNM, "IPACC: RSL CONNECT ACK");
+		DEBUGPC(DNM, "RSL CONNECT ACK ");
 		if (TLVP_PRESENT(&tp, NM_ATT_IPACC_RSL_BSC_IP))
 			DEBUGPC(DNM, "IP=%s\n",
 				inet_ntoa(*((struct in_addr *) 
@@ -2026,16 +2028,27 @@
 					TLVP_VAL(&tp, NM_ATT_IPACC_RSL_BSC_PORT))));
 		break;
 	case NM_MT_IPACC_RSL_CONNECT_NACK:
-		DEBUGP(DNM, "IPACC: RSL CONNECT NACK");
+		DEBUGPC(DNM, "RSL CONNECT NACK ");
 		if (TLVP_PRESENT(&tp, NM_ATT_NACK_CAUSES))
 			DEBUGPC(DNM, " CAUSE=0x%02x\n", *TLVP_VAL(&tp, NM_ATT_NACK_CAUSES));
 		else
 			DEBUGPC(DNM, "\n");
 		break;
+	case NM_MT_IPACC_SET_NVATTR_ACK:
+		DEBUGPC(DNM, "SET NVATTR ACK\n");
+		/* FIXME: decode and show the actual attributes */
+		break;
+	case NM_MT_IPACC_SET_NVATTR_NACK:
+		DEBUGPC(DNM, "SET NVATTR NACK\n");
+		break;
+	default:
+		DEBUGPC(DNM, "unknown\n");
+		break;
 	}
 	return 0;
 }
 
+/* send an ip-access manufacturer specific message */
 int abis_nm_ipaccess_msg(struct gsm_bts *bts, u_int8_t msg_type,
 			 u_int8_t obj_class, u_int8_t bts_nr,
 			 u_int8_t trx_nr, u_int8_t ts_nr,
@@ -2072,3 +2085,17 @@
 	return abis_nm_sendmsg(bts, msg);
 }
 
+/* set some attributes in NVRAM */
+int abis_nm_ipaccess_set_nvattr(struct gsm_bts *bts, u_int8_t *attr,
+				int attr_len)
+{
+	return abis_nm_ipaccess_msg(bts, NM_MT_IPACC_SET_NVATTR,
+				    NM_OC_BASEB_TRANSC, 0, 0, 0xff, attr,
+				    attr_len);
+}
+
+/* restart / reboot an ip.access nanoBTS */
+int abis_nm_ipaccess_restart(struct gsm_bts *bts)
+{
+	return __simple_cmd(bts, NM_MT_IPACC_RESTART);
+}