diff --git a/openbsc/include/openbsc/abis_nm.h b/openbsc/include/openbsc/abis_nm.h
index 3aac31f..bad7d1d 100644
--- a/openbsc/include/openbsc/abis_nm.h
+++ b/openbsc/include/openbsc/abis_nm.h
@@ -116,7 +116,7 @@
 	NM_MT_SET_CHAN_ATTR_NACK,
 	/* Test Management Messages */
 	NM_MT_PERF_TEST			= 0x51,
-	NM_MT_PERF_TESET_ACK,
+	NM_MT_PERF_TEST_ACK,
 	NM_MT_PERF_TEST_NACK,
 	NM_MT_TEST_REP,
 	NM_MT_SEND_TEST_REP,
@@ -338,7 +338,7 @@
 	NM_ATT_BS11_ALL_TEST_CATG	= 0x60,
 	NM_ATT_BS11_BTSLS_HOPPING,
 	NM_ATT_BS11_CELL_ALLOC_NR,
-	NM_ATT_BS11_CALL_GLOBAL_ID,
+	NM_ATT_BS11_CELL_GLOBAL_ID,
 	NM_ATT_BS11_ENA_INTERF_CLASS	= 0x66,
 	NM_ATT_BS11_ENA_INT_INTEC_HANDO	= 0x67,
 	NM_ATT_BS11_ENA_INT_INTRC_HANDO	= 0x68,
@@ -422,7 +422,7 @@
 	NM_CHANC_TCHHalf2	= 0x02,
 	NM_CHANC_SDCCH		= 0x03,
 	NM_CHANC_mainBCCH	= 0x04,
-	NM_CHANC_BCCCHComb	= 0x05,
+	NM_CHANC_BCCHComb	= 0x05,
 	NM_CHANC_BCCH		= 0x06,
 	NM_CHANC_BCCH_CBCH	= 0x07,
 	NM_CHANC_SDCCH_CBCH	= 0x08,
@@ -484,7 +484,7 @@
 	NM_NACK_MSGINCONSIST_PHYSCFG	= 0x23,
 	NM_NACK_FILE_INCOMPLETE		= 0x25,
 	NM_NACK_FILE_NOTAVAIL		= 0x26,
-	MN_NACK_FILE_NOTACTIVATE	= 0x27,
+	NM_NACK_FILE_NOTACTIVATE	= 0x27,
 	NM_NACK_REQ_NOT_GRANT		= 0x28,
 	NM_NACK_WAIT			= 0x29,
 	NM_NACK_NOTH_REPORT_EXIST	= 0x2a,
diff --git a/openbsc/include/openbsc/gsm_data.h b/openbsc/include/openbsc/gsm_data.h
index 54ce7e6..9b4cf9d 100644
--- a/openbsc/include/openbsc/gsm_data.h
+++ b/openbsc/include/openbsc/gsm_data.h
@@ -46,8 +46,6 @@
 
 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
 
-#define GSM_MAX_BTS	8
-#define BTS_MAX_TRX	8
 #define TRX_NR_TS	8
 #define TS_MAX_LCHAN	8
 
@@ -216,6 +214,9 @@
 
 /* One TRX in a BTS */
 struct gsm_bts_trx {
+	/* list header in bts->trx_list */
+	struct llist_head list;
+
 	struct gsm_bts *bts;
 	/* number of this TRX in the BTS */
 	u_int8_t nr;
@@ -297,6 +298,9 @@
 
 /* One BTS */
 struct gsm_bts {
+	/* list header in net->bts_list */
+	struct llist_head list;
+
 	struct gsm_network *network;
 	/* number of ths BTS in network */
 	u_int8_t nr;
@@ -351,7 +355,7 @@
 	
 	/* transceivers */
 	int num_trx;
-	struct gsm_bts_trx trx[BTS_MAX_TRX+1];
+	struct llist_head trx_list;
 };
 
 struct gsm_network {
@@ -367,8 +371,7 @@
 	struct llist_head trans_list;
 
 	unsigned int num_bts;
-	/* private lists */
-	struct gsm_bts	bts[GSM_MAX_BTS+1];
+	struct llist_head bts_list;
 };
 
 #define SMS_HDR_SIZE	128
@@ -382,9 +385,14 @@
 	char text[SMS_TEXT_SIZE];
 };
 
-struct gsm_network *gsm_network_init(unsigned int num_bts, enum gsm_bts_type bts_type,
-				     u_int16_t country_code, u_int16_t network_code,
+struct gsm_network *gsm_network_init(u_int16_t country_code, u_int16_t network_code,
 				     int (*mncc_recv)(struct gsm_network *, int, void *));
+struct gsm_bts *gsm_bts_alloc(struct gsm_network *net, enum gsm_bts_type type,
+			      u_int8_t tsc, u_int8_t bsic);
+struct gsm_bts_trx *gsm_bts_trx_alloc(struct gsm_bts *bts);
+
+struct gsm_bts *gsm_bts_num(struct gsm_network *net, int num);
+struct gsm_bts_trx *gsm_bts_trx_num(struct gsm_bts *bts, int num);
 
 const char *gsm_pchan_name(enum gsm_phys_chan_config c);
 const char *gsm_lchan_name(enum gsm_chan_t c);
@@ -407,6 +415,8 @@
 char *gsm_band_name(enum gsm_band band);
 enum gsm_band gsm_band_parse(int mhz);
 
+void *tall_bsc_ctx;
+
 static inline int is_ipaccess_bts(struct gsm_bts *bts)
 {
 	switch (bts->type) {
diff --git a/openbsc/include/openbsc/mncc.h b/openbsc/include/openbsc/mncc.h
index c04a81f..6aa1917 100644
--- a/openbsc/include/openbsc/mncc.h
+++ b/openbsc/include/openbsc/mncc.h
@@ -193,6 +193,7 @@
 	int		more;
 	int		notify; /* 0..127 */
 	int		emergency;
+	char		imsi[16];
 
 	unsigned char	lchan_mode;
 };
diff --git a/openbsc/include/openbsc/msgb.h b/openbsc/include/openbsc/msgb.h
index 2c31d15..5ecac45 100644
--- a/openbsc/include/openbsc/msgb.h
+++ b/openbsc/include/openbsc/msgb.h
@@ -47,7 +47,7 @@
 	unsigned char _data[0];
 };
 
-extern struct msgb *msgb_alloc(u_int16_t size);
+extern struct msgb *msgb_alloc(u_int16_t size, const char *name);
 extern void msgb_free(struct msgb *m);
 extern void msgb_enqueue(struct llist_head *queue, struct msgb *msg);
 extern struct msgb *msgb_dequeue(struct llist_head *queue);
@@ -100,9 +100,10 @@
 	msg->tail += len;
 }
 
-static inline struct msgb *msgb_alloc_headroom(int size, int headroom)
+static inline struct msgb *msgb_alloc_headroom(int size, int headroom,
+						const char *name)
 {
-	struct msgb *msg = msgb_alloc(size);
+	struct msgb *msg = msgb_alloc(size, name);
 	if (msg)
 		msgb_reserve(msg, headroom);
 	return msg;
diff --git a/openbsc/include/openbsc/talloc.h b/openbsc/include/openbsc/talloc.h
new file mode 100644
index 0000000..a4b33c3
--- /dev/null
+++ b/openbsc/include/openbsc/talloc.h
@@ -0,0 +1,190 @@
+#ifndef _TALLOC_H_
+#define _TALLOC_H_
+/* 
+   Unix SMB/CIFS implementation.
+   Samba temporary memory allocation functions
+
+   Copyright (C) Andrew Tridgell 2004-2005
+   Copyright (C) Stefan Metzmacher 2006
+   
+     ** NOTE! The following LGPL license applies to the talloc
+     ** library. This does NOT imply that all of Samba is released
+     ** under the LGPL
+   
+   This library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 3 of the License, or (at your option) any later version.
+
+   This library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with this library; if not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <stdarg.h>
+
+/* this is only needed for compatibility with the old talloc */
+typedef void TALLOC_CTX;
+
+/*
+  this uses a little trick to allow __LINE__ to be stringified
+*/
+#ifndef __location__
+#define __TALLOC_STRING_LINE1__(s)    #s
+#define __TALLOC_STRING_LINE2__(s)   __TALLOC_STRING_LINE1__(s)
+#define __TALLOC_STRING_LINE3__  __TALLOC_STRING_LINE2__(__LINE__)
+#define __location__ __FILE__ ":" __TALLOC_STRING_LINE3__
+#endif
+
+#ifndef TALLOC_DEPRECATED
+#define TALLOC_DEPRECATED 0
+#endif
+
+#ifndef PRINTF_ATTRIBUTE
+#if (__GNUC__ >= 3)
+/** Use gcc attribute to check printf fns.  a1 is the 1-based index of
+ * the parameter containing the format, and a2 the index of the first
+ * argument. Note that some gcc 2.x versions don't handle this
+ * properly **/
+#define PRINTF_ATTRIBUTE(a1, a2) __attribute__ ((format (__printf__, a1, a2)))
+#else
+#define PRINTF_ATTRIBUTE(a1, a2)
+#endif
+#endif
+
+/* try to make talloc_set_destructor() and talloc_steal() type safe,
+   if we have a recent gcc */
+#if (__GNUC__ >= 3)
+#define _TALLOC_TYPEOF(ptr) __typeof__(ptr)
+#define talloc_set_destructor(ptr, function)				      \
+	do {								      \
+		int (*_talloc_destructor_fn)(_TALLOC_TYPEOF(ptr)) = (function);	      \
+		_talloc_set_destructor((ptr), (int (*)(void *))_talloc_destructor_fn); \
+	} while(0)
+/* this extremely strange macro is to avoid some braindamaged warning
+   stupidity in gcc 4.1.x */
+#define talloc_steal(ctx, ptr) ({ _TALLOC_TYPEOF(ptr) __talloc_steal_ret = (_TALLOC_TYPEOF(ptr))_talloc_steal((ctx),(ptr)); __talloc_steal_ret; })
+#else
+#define talloc_set_destructor(ptr, function) \
+	_talloc_set_destructor((ptr), (int (*)(void *))(function))
+#define _TALLOC_TYPEOF(ptr) void *
+#define talloc_steal(ctx, ptr) (_TALLOC_TYPEOF(ptr))_talloc_steal((ctx),(ptr))
+#endif
+
+#define talloc_reference(ctx, ptr) (_TALLOC_TYPEOF(ptr))_talloc_reference((ctx),(ptr))
+#define talloc_move(ctx, ptr) (_TALLOC_TYPEOF(*(ptr)))_talloc_move((ctx),(void *)(ptr))
+
+/* useful macros for creating type checked pointers */
+#define talloc(ctx, type) (type *)talloc_named_const(ctx, sizeof(type), #type)
+#define talloc_size(ctx, size) talloc_named_const(ctx, size, __location__)
+#define talloc_ptrtype(ctx, ptr) (_TALLOC_TYPEOF(ptr))talloc_size(ctx, sizeof(*(ptr)))
+
+#define talloc_new(ctx) talloc_named_const(ctx, 0, "talloc_new: " __location__)
+
+#define talloc_zero(ctx, type) (type *)_talloc_zero(ctx, sizeof(type), #type)
+#define talloc_zero_size(ctx, size) _talloc_zero(ctx, size, __location__)
+
+#define talloc_zero_array(ctx, type, count) (type *)_talloc_zero_array(ctx, sizeof(type), count, #type)
+#define talloc_array(ctx, type, count) (type *)_talloc_array(ctx, sizeof(type), count, #type)
+#define talloc_array_size(ctx, size, count) _talloc_array(ctx, size, count, __location__)
+#define talloc_array_ptrtype(ctx, ptr, count) (_TALLOC_TYPEOF(ptr))talloc_array_size(ctx, sizeof(*(ptr)), count)
+#define talloc_array_length(ctx) (talloc_get_size(ctx)/sizeof(*ctx))
+
+#define talloc_realloc(ctx, p, type, count) (type *)_talloc_realloc_array(ctx, p, sizeof(type), count, #type)
+#define talloc_realloc_size(ctx, ptr, size) _talloc_realloc(ctx, ptr, size, __location__)
+
+#define talloc_memdup(t, p, size) _talloc_memdup(t, p, size, __location__)
+
+#define talloc_set_type(ptr, type) talloc_set_name_const(ptr, #type)
+#define talloc_get_type(ptr, type) (type *)talloc_check_name(ptr, #type)
+#define talloc_get_type_abort(ptr, type) (type *)_talloc_get_type_abort(ptr, #type, __location__)
+
+#define talloc_find_parent_bytype(ptr, type) (type *)talloc_find_parent_byname(ptr, #type)
+
+#if TALLOC_DEPRECATED
+#define talloc_zero_p(ctx, type) talloc_zero(ctx, type)
+#define talloc_p(ctx, type) talloc(ctx, type)
+#define talloc_array_p(ctx, type, count) talloc_array(ctx, type, count)
+#define talloc_realloc_p(ctx, p, type, count) talloc_realloc(ctx, p, type, count)
+#define talloc_destroy(ctx) talloc_free(ctx)
+#define talloc_append_string(c, s, a) (s?talloc_strdup_append(s,a):talloc_strdup(c, a))
+#endif
+
+#define TALLOC_FREE(ctx) do { talloc_free(ctx); ctx=NULL; } while(0)
+
+/* The following definitions come from talloc.c  */
+void *_talloc(const void *context, size_t size);
+void *talloc_pool(const void *context, size_t size);
+void _talloc_set_destructor(const void *ptr, int (*_destructor)(void *));
+int talloc_increase_ref_count(const void *ptr);
+size_t talloc_reference_count(const void *ptr);
+void *_talloc_reference(const void *context, const void *ptr);
+int talloc_unlink(const void *context, void *ptr);
+const char *talloc_set_name(const void *ptr, const char *fmt, ...) PRINTF_ATTRIBUTE(2,3);
+void talloc_set_name_const(const void *ptr, const char *name);
+void *talloc_named(const void *context, size_t size, 
+		   const char *fmt, ...) PRINTF_ATTRIBUTE(3,4);
+void *talloc_named_const(const void *context, size_t size, const char *name);
+const char *talloc_get_name(const void *ptr);
+void *talloc_check_name(const void *ptr, const char *name);
+void *_talloc_get_type_abort(const void *ptr, const char *name, const char *location);
+void *talloc_parent(const void *ptr);
+const char *talloc_parent_name(const void *ptr);
+void *talloc_init(const char *fmt, ...) PRINTF_ATTRIBUTE(1,2);
+int talloc_free(void *ptr);
+void talloc_free_children(void *ptr);
+void *_talloc_realloc(const void *context, void *ptr, size_t size, const char *name);
+void *_talloc_steal(const void *new_ctx, const void *ptr);
+void *_talloc_move(const void *new_ctx, const void *pptr);
+size_t talloc_total_size(const void *ptr);
+size_t talloc_total_blocks(const void *ptr);
+void talloc_report_depth_cb(const void *ptr, int depth, int max_depth,
+			    void (*callback)(const void *ptr,
+			  		     int depth, int max_depth,
+					     int is_ref,
+					     void *private_data),
+			    void *private_data);
+void talloc_report_depth_file(const void *ptr, int depth, int max_depth, FILE *f);
+void talloc_report_full(const void *ptr, FILE *f);
+void talloc_report(const void *ptr, FILE *f);
+void talloc_enable_null_tracking(void);
+void talloc_disable_null_tracking(void);
+void talloc_enable_leak_report(void);
+void talloc_enable_leak_report_full(void);
+void *_talloc_zero(const void *ctx, size_t size, const char *name);
+void *_talloc_memdup(const void *t, const void *p, size_t size, const char *name);
+void *_talloc_array(const void *ctx, size_t el_size, unsigned count, const char *name);
+void *_talloc_zero_array(const void *ctx, size_t el_size, unsigned count, const char *name);
+void *_talloc_realloc_array(const void *ctx, void *ptr, size_t el_size, unsigned count, const char *name);
+void *talloc_realloc_fn(const void *context, void *ptr, size_t size);
+void *talloc_autofree_context(void);
+size_t talloc_get_size(const void *ctx);
+void *talloc_find_parent_byname(const void *ctx, const char *name);
+void talloc_show_parents(const void *context, FILE *file);
+int talloc_is_parent(const void *context, const void *ptr);
+
+char *talloc_strdup(const void *t, const char *p);
+char *talloc_strdup_append(char *s, const char *a);
+char *talloc_strdup_append_buffer(char *s, const char *a);
+
+char *talloc_strndup(const void *t, const char *p, size_t n);
+char *talloc_strndup_append(char *s, const char *a, size_t n);
+char *talloc_strndup_append_buffer(char *s, const char *a, size_t n);
+
+char *talloc_vasprintf(const void *t, const char *fmt, va_list ap) PRINTF_ATTRIBUTE(2,0);
+char *talloc_vasprintf_append(char *s, const char *fmt, va_list ap) PRINTF_ATTRIBUTE(2,0);
+char *talloc_vasprintf_append_buffer(char *s, const char *fmt, va_list ap) PRINTF_ATTRIBUTE(2,0);
+
+char *talloc_asprintf(const void *t, const char *fmt, ...) PRINTF_ATTRIBUTE(2,3);
+char *talloc_asprintf_append(char *s, const char *fmt, ...) PRINTF_ATTRIBUTE(2,3);
+char *talloc_asprintf_append_buffer(char *s, const char *fmt, ...) PRINTF_ATTRIBUTE(2,3);
+
+void talloc_set_abort_fn(void (*abort_fn)(const char *reason));
+
+#endif
diff --git a/openbsc/src/Makefile.am b/openbsc/src/Makefile.am
index f4b8e55..c0ac63c 100644
--- a/openbsc/src/Makefile.am
+++ b/openbsc/src/Makefile.am
@@ -9,7 +9,7 @@
 		gsm_subscriber.c msgb.c select.c chan_alloc.c timer.c debug.c db.c \
 		gsm_04_11.c telnet_interface.c subchan_demux.c \
 		trau_frame.c trau_mux.c paging.c e1_config.c e1_input.c tlv_parser.c \
-		input/misdn.c input/ipaccess.c signal.c gsm_utils.c
+		input/misdn.c input/ipaccess.c signal.c gsm_utils.c talloc.c
 
 libvty_a_SOURCES = vty/buffer.c vty/command.c vty/vector.c vty/vty.c
 
@@ -17,7 +17,7 @@
 bsc_hack_LDADD = libbsc.a libvty.a -ldl -ldbi $(LIBCRYPT)
 
 bs11_config_SOURCES = bs11_config.c abis_nm.c gsm_data.c msgb.c debug.c \
-		      select.c timer.c rs232.c tlv_parser.c signal.c
+		      select.c timer.c rs232.c tlv_parser.c signal.c talloc.c
 
 ipaccess_find_SOURCES = ipaccess-find.c select.c timer.c
 
diff --git a/openbsc/src/abis_nm.c b/openbsc/src/abis_nm.c
index 905289b..b07aa31 100644
--- a/openbsc/src/abis_nm.c
+++ b/openbsc/src/abis_nm.c
@@ -43,6 +43,7 @@
 #include <openbsc/abis_nm.h>
 #include <openbsc/misdn.h>
 #include <openbsc/signal.h>
+#include <openbsc/talloc.h>
 
 #define OM_ALLOC_SIZE		1024
 #define OM_HEADROOM_SIZE	128
@@ -178,7 +179,7 @@
 	[NM_NACK_MSGINCONSIST_PHYSCFG]	= "Message inconsistent with physical configuration",
 	[NM_NACK_FILE_INCOMPLETE]	= "Complete file notreceived",
 	[NM_NACK_FILE_NOTAVAIL]		= "File not available at destination",
-	[MN_NACK_FILE_NOTACTIVATE]	= "File cannot be activate",
+	[NM_NACK_FILE_NOTACTIVATE]	= "File cannot be activate",
 	[NM_NACK_REQ_NOT_GRANT]		= "Request not granted",
 	[NM_NACK_WAIT]			= "Wait",
 	[NM_NACK_NOTH_REPORT_EXIST]	= "Nothing reportable existing",
@@ -422,7 +423,8 @@
 
 static struct msgb *nm_msgb_alloc(void)
 {
-	return msgb_alloc_headroom(OM_ALLOC_SIZE, OM_HEADROOM_SIZE);
+	return msgb_alloc_headroom(OM_ALLOC_SIZE, OM_HEADROOM_SIZE,
+				   "OML");
 }
 
 /* Send a OML NM Message from BSC to BTS */
@@ -543,19 +545,19 @@
 	case NM_OC_RADIO_CARRIER:
 		if (obj_inst->trx_nr >= bts->num_trx)
 			return NULL;
-		trx = &bts->trx[obj_inst->trx_nr];
+		trx = gsm_bts_trx_num(bts, obj_inst->trx_nr);
 		nm_state = &trx->nm_state;
 		break;
 	case NM_OC_BASEB_TRANSC:
 		if (obj_inst->trx_nr >= bts->num_trx)
 			return NULL;
-		trx = &bts->trx[obj_inst->trx_nr];
+		trx = gsm_bts_trx_num(bts, obj_inst->trx_nr);
 		nm_state = &trx->bb_transc.nm_state;
 		break;
 	case NM_OC_CHANNEL:
 		if (obj_inst->trx_nr > bts->num_trx)
 			return NULL;
-		trx = &bts->trx[obj_inst->trx_nr];
+		trx = gsm_bts_trx_num(bts, obj_inst->trx_nr);
 		if (obj_inst->ts_nr >= TRX_NR_TS)
 			return NULL;
 		nm_state = &trx->ts[obj_inst->ts_nr].nm_state;
@@ -571,13 +573,13 @@
 		case BS11_OBJ_BBSIG:
 			if (obj_inst->ts_nr > bts->num_trx)
 				return NULL;
-			trx = &bts->trx[obj_inst->ts_nr];
+			trx = gsm_bts_trx_num(bts, obj_inst->trx_nr);
 			nm_state = &trx->bs11.bbsig.nm_state;
 			break;
 		case BS11_OBJ_PA:
 			if (obj_inst->ts_nr > bts->num_trx)
 				return NULL;
-			trx = &bts->trx[obj_inst->ts_nr];
+			trx = gsm_bts_trx_num(bts, obj_inst->trx_nr);
 			nm_state = &trx->bs11.pa.nm_state;
 			break;
 		default:
@@ -610,19 +612,19 @@
 	case NM_OC_RADIO_CARRIER:
 		if (obj_inst->trx_nr >= bts->num_trx)
 			return NULL;
-		trx = &bts->trx[obj_inst->trx_nr];
+		trx = gsm_bts_trx_num(bts, obj_inst->trx_nr);
 		obj = trx;
 		break;
 	case NM_OC_BASEB_TRANSC:
 		if (obj_inst->trx_nr >= bts->num_trx)
 			return NULL;
-		trx = &bts->trx[obj_inst->trx_nr];
+		trx = gsm_bts_trx_num(bts, obj_inst->trx_nr);
 		obj = &trx->bb_transc;
 		break;
 	case NM_OC_CHANNEL:
 		if (obj_inst->trx_nr > bts->num_trx)
 			return NULL;
-		trx = &bts->trx[obj_inst->trx_nr];
+		trx = gsm_bts_trx_num(bts, obj_inst->trx_nr);
 		if (obj_inst->ts_nr >= TRX_NR_TS)
 			return NULL;
 		obj = &trx->ts[obj_inst->ts_nr];
@@ -2008,6 +2010,8 @@
 
 /* BS11 SWL */
 
+static void *tall_fle_ctx;
+
 struct abis_nm_bs11_sw {
 	struct gsm_bts *bts;
 	char swl_fname[PATH_MAX];
@@ -2043,6 +2047,10 @@
 	FILE *swl;
 	int rc = 0;
 
+	if (!tall_fle_ctx)
+		tall_fle_ctx = talloc_named_const(tall_bsc_ctx, 1, 
+						  "bs11_file_list_entry");
+
 	swl = fopen(bs11_sw->swl_fname, "r");
 	if (!swl)
 		return -ENODEV;
@@ -2050,7 +2058,7 @@
 	/* zero the stale file list, if any */
 	llist_for_each_safe(lh, lh2, &bs11_sw->file_list) {
 		llist_del(lh);
-		free(lh);
+		talloc_free(lh);
 	}
 
 	while (fgets(linebuf, sizeof(linebuf), swl)) {
@@ -2071,12 +2079,11 @@
 		if (rc < 2)
 			continue;
 
-		fle = malloc(sizeof(*fle));
+		fle = talloc_zero(tall_fle_ctx, struct file_list_entry);
 		if (!fle) {
 			rc = -ENOMEM;
 			goto out;
 		}
-		memset(fle, 0, sizeof(*fle));
 
 		/* construct new filename */
 		strncpy(dir, bs11_sw->swl_fname, sizeof(dir));
diff --git a/openbsc/src/abis_rsl.c b/openbsc/src/abis_rsl.c
index b8990c7..0488b9d 100644
--- a/openbsc/src/abis_rsl.c
+++ b/openbsc/src/abis_rsl.c
@@ -293,7 +293,8 @@
 
 static struct msgb *rsl_msgb_alloc(void)
 {
-	return msgb_alloc_headroom(RSL_ALLOC_SIZE, RSL_ALLOC_HEADROOM);
+	return msgb_alloc_headroom(RSL_ALLOC_SIZE, RSL_ALLOC_HEADROOM,
+				   "RSL");
 }
 
 #define MACBLOCK_SIZE	23
diff --git a/openbsc/src/bs11_config.c b/openbsc/src/bs11_config.c
index 386b865..0fb7cd7 100644
--- a/openbsc/src/bs11_config.c
+++ b/openbsc/src/bs11_config.c
@@ -94,7 +94,7 @@
 
 	abis_nm_bs11_conn_oml_tei(bts, 0, 1, 0xff, TEI_OML);
 
-	abis_nm_bs11_set_trx_power(&bts->trx[0], BS11_TRX_POWER_GSM_30mW);
+	abis_nm_bs11_set_trx_power(bts->c0, BS11_TRX_POWER_GSM_30mW);
 	
 	sleep(1);
 
@@ -109,6 +109,10 @@
 {
 	u_int8_t bbsig1_attr[sizeof(obj_bbsig0_attr)+12];
 	u_int8_t *cur = bbsig1_attr;
+	struct gsm_bts_trx *trx = gsm_bts_trx_num(bts, 1);
+
+	if (!trx)
+		trx = gsm_bts_trx_alloc(bts);
 
 	fprintf(stdout, "Crating Objects for TRX1\n");
 
@@ -123,7 +127,7 @@
 				   sizeof(bbsig1_attr), bbsig1_attr);
 	abis_nm_bs11_create_object(bts, BS11_OBJ_PA, 1,
 				   sizeof(obj_pa0_attr), obj_pa0_attr);
-	abis_nm_bs11_set_trx_power(&bts->trx[1], BS11_TRX_POWER_GSM_30mW);
+	abis_nm_bs11_set_trx_power(trx, BS11_TRX_POWER_GSM_30mW);
 	
 	return 0;
 }
@@ -437,13 +441,17 @@
 
 static void cmd_query(void)
 {
+	struct gsm_bts_trx *trx = g_bts->c0;
+
 	bs11cfg_state = STATE_QUERY;
 	abis_nm_bs11_get_serno(g_bts);
 	abis_nm_bs11_get_oml_tei_ts(g_bts);
 	abis_nm_bs11_get_pll_mode(g_bts);
 	abis_nm_bs11_get_cclk(g_bts);
-	abis_nm_bs11_get_trx_power(&g_bts->trx[0]);
-	abis_nm_bs11_get_trx_power(&g_bts->trx[1]);
+	abis_nm_bs11_get_trx_power(trx);
+	trx = gsm_bts_trx_num(g_bts, 1);
+	if (trx)
+		abis_nm_bs11_get_trx_power(trx);
 	sleep(1);
 	abis_nm_bs11_factory_logon(g_bts, 0);
 	command = NULL;
@@ -775,12 +783,13 @@
 
 	handle_options(argc, argv);
 
-	gsmnet = gsm_network_init(1, 1, 1, GSM_BTS_TYPE_BS11, NULL);
+	gsmnet = gsm_network_init(1, 1, NULL);
 	if (!gsmnet) {
 		fprintf(stderr, "Unable to allocate gsm network\n");
 		exit(1);
 	}
-	g_bts = &gsmnet->bts[0];
+	g_bts = gsm_bts_alloc(gsmnet, GSM_BTS_TYPE_BS11, HARDCODED_TSC,
+				HARDCODED_BSIC);
 
 	rc = rs232_setup(serial_port, delay_ms, g_bts);
 	if (rc < 0) {
diff --git a/openbsc/src/bsc_hack.c b/openbsc/src/bsc_hack.c
index 43f1011..7e000ad 100644
--- a/openbsc/src/bsc_hack.c
+++ b/openbsc/src/bsc_hack.c
@@ -47,6 +47,9 @@
 #include <openbsc/paging.h>
 #include <openbsc/e1_input.h>
 #include <openbsc/signal.h>
+#include <openbsc/talloc.h>
+
+void *tall_bsc_ctx;
 
 /* global pointer to the gsm network data structure */
 static struct gsm_network *gsmnet;
@@ -487,7 +490,7 @@
 
 static void bootstrap_om_bs11(struct gsm_bts *bts)
 {
-	struct gsm_bts_trx *trx = &bts->trx[0];
+	struct gsm_bts_trx *trx = bts->c0;
 
 	/* stop sending event reports */
 	abis_nm_event_reports(bts, 0);
@@ -605,10 +608,11 @@
 
 static int shutdown_net(struct gsm_network *net)
 {
-	int i;
-	for (i = 0; i < net->num_bts; i++) {
+	struct gsm_bts *bts;
+
+	llist_for_each_entry(bts, &net->bts_list, list) {
 		int rc;
-		rc = shutdown_om(&net->bts[i]);
+		rc = shutdown_om(bts);
 		if (rc < 0)
 			return rc;
 	}
@@ -846,8 +850,8 @@
  */
 static void patch_tables(struct gsm_bts *bts)
 {
-	u_int8_t arfcn_low = bts->trx[0].arfcn & 0xff;
-	u_int8_t arfcn_high = (bts->trx[0].arfcn >> 8) & 0x0f;
+	u_int8_t arfcn_low = bts->c0->arfcn & 0xff;
+	u_int8_t arfcn_high = (bts->c0->arfcn >> 8) & 0x0f;
 	/* covert the raw packet to the struct */
 	struct gsm48_system_information_type_3 *type_3 =
 		(struct gsm48_system_information_type_3*)&si3;
@@ -930,7 +934,7 @@
 {
 	bts->band = BAND;
 	bts->location_area_code = LAC;
-	bts->trx[0].arfcn = ARFCN;
+	bts->c0->arfcn = ARFCN;
 
 	/* Control Channel Description */
 	memset(&bts->chan_desc, 0, sizeof(struct gsm48_control_channel_descr));
@@ -944,7 +948,7 @@
 	paging_init(bts);
 
 	if (bts->type == GSM_BTS_TYPE_BS11) {
-		struct gsm_bts_trx *trx = &bts->trx[0];
+		struct gsm_bts_trx *trx = bts->c0;
 		set_ts_e1link(&trx->ts[0], 0, 1, 0xff);
 		set_ts_e1link(&trx->ts[1], 0, 2, 1);
 		set_ts_e1link(&trx->ts[2], 0, 2, 2);
@@ -995,14 +999,14 @@
 	}
 
 	/* initialize our data structures */
-	gsmnet = gsm_network_init(2, BTS_TYPE, MCC, MNC, mncc_recv);
+	gsmnet = gsm_network_init(MCC, MNC, mncc_recv);
 	if (!gsmnet)
 		return -ENOMEM;
 
 	gsmnet->name_long = "OpenBSC";
 	gsmnet->name_short = "OpenBSC";
 
-	bts = &gsmnet->bts[0];
+	bts = gsm_bts_alloc(gsmnet, BTS_TYPE, HARDCODED_TSC, HARDCODED_BSIC);
 	bootstrap_bts(bts);
 
 	if (db_init(database_name)) {
@@ -1030,7 +1034,7 @@
 		bts->ip_access.site_id = 1801;
 		bts->ip_access.bts_id = 0;
 
-		bts = &gsmnet->bts[1];
+		bts = gsm_bts_alloc(gsmnet, BTS_TYPE, HARDCODED_TSC, HARDCODED_BSIC);
 		bootstrap_bts(bts);
 		bts->ip_access.site_id = 1800;
 		bts->ip_access.bts_id = 0;
@@ -1170,6 +1174,9 @@
 	case SIGABRT:
 		shutdown_net(gsmnet);
 		break;
+	case SIGUSR1:
+		talloc_report_full(tall_bsc_ctx, stderr);
+		break;
 	default:
 		break;
 	}
@@ -1179,6 +1186,8 @@
 {
 	int rc;
 
+	tall_bsc_ctx = talloc_named_const(NULL, 1, "openbsc");
+
 	/* parse options */
 	handle_options(argc, argv);
 
@@ -1191,6 +1200,7 @@
 
 	signal(SIGHUP, &signal_handler);
 	signal(SIGABRT, &signal_handler);
+	signal(SIGUSR1, &signal_handler);
 
 	while (1) {
 		bsc_upqueue(gsmnet);
diff --git a/openbsc/src/chan_alloc.c b/openbsc/src/chan_alloc.c
index 96632bc..fe16815 100644
--- a/openbsc/src/chan_alloc.c
+++ b/openbsc/src/chan_alloc.c
@@ -38,7 +38,7 @@
 struct gsm_bts_trx_ts *ts_c0_alloc(struct gsm_bts *bts,
 				   enum gsm_phys_chan_config pchan)
 {
-	struct gsm_bts_trx *trx = &bts->trx[0];	
+	struct gsm_bts_trx *trx = bts->c0;
 	struct gsm_bts_trx_ts *ts = &trx->ts[0];
 
 	if (pchan != GSM_PCHAN_CCCH &&
@@ -55,7 +55,7 @@
 
 static const enum abis_nm_chan_comb chcomb4pchan[] = {
 	[GSM_PCHAN_CCCH]	= NM_CHANC_mainBCCH,
-	[GSM_PCHAN_CCCH_SDCCH4]	= NM_CHANC_BCCCHComb,
+	[GSM_PCHAN_CCCH_SDCCH4]	= NM_CHANC_BCCHComb,
 	[GSM_PCHAN_TCH_F]	= NM_CHANC_TCHFull,
 	[GSM_PCHAN_TCH_H]	= NM_CHANC_TCHHalf,
 	[GSM_PCHAN_SDCCH8_SACCH8C] = NM_CHANC_SDCCH,
@@ -68,7 +68,7 @@
 {
 	int i, j;
 	for (i = 0; i < bts->num_trx; i++) {
-		struct gsm_bts_trx *trx = &bts->trx[i];
+		struct gsm_bts_trx *trx = gsm_bts_trx_num(bts, i);
 		int from, to;
 
 		/* the following constraints are pure policy,
@@ -124,7 +124,7 @@
 	struct gsm_bts_trx_ts *ts;
 	int i, j, ss;
 	for (i = 0; i < bts->num_trx; i++) {
-		trx = &bts->trx[i];
+		trx = gsm_bts_trx_num(bts, i);
 		for (j = 0; j < 8; j++) {
 			ts = &trx->ts[j];
 			if (ts->pchan != pchan)
@@ -239,13 +239,14 @@
 }
 
 struct gsm_lchan* lchan_find(struct gsm_bts *bts, struct gsm_subscriber *subscr) {
-	int trx, ts_no, lchan_no; 
+	struct gsm_bts_trx *trx;
+	int ts_no, lchan_no; 
 
-	for (trx = 0; trx < bts->num_trx; ++trx) {
+	llist_for_each_entry(trx, &bts->trx_list, list) {
 		for (ts_no = 0; ts_no < 8; ++ts_no) {
 			for (lchan_no = 0; lchan_no < TS_MAX_LCHAN; ++lchan_no) {
 				struct gsm_lchan *lchan =
-					&bts->trx[trx].ts[ts_no].lchan[lchan_no];
+					&trx->ts[ts_no].lchan[lchan_no];
 				if (subscr == lchan->subscr)
 					return lchan;
 			}
diff --git a/openbsc/src/e1_config.c b/openbsc/src/e1_config.c
index fc23b55..9c9f40c 100644
--- a/openbsc/src/e1_config.c
+++ b/openbsc/src/e1_config.c
@@ -8,6 +8,7 @@
 #include <openbsc/trau_frame.h>
 #include <openbsc/trau_mux.h>
 #include <openbsc/misdn.h>
+#include <openbsc/talloc.h>
 
 #define SAPI_L2ML	0
 #define SAPI_OML	62
@@ -24,10 +25,9 @@
 	struct e1inp_ts *sign_ts;
 	struct e1inp_sign_link *oml_link, *rsl_link;
 
-	line = malloc(sizeof(*line));
+	line = talloc_zero(tall_bsc_ctx, struct e1inp_line);
 	if (!line)
 		return -ENOMEM;
-	memset(line, 0, sizeof(*line));
 
 	/* create E1 timeslots for signalling and TRAU frames */
 	e1inp_ts_config(&line->ts[1-1], line, E1INP_TS_TYPE_SIGN);
@@ -79,10 +79,9 @@
 	struct e1inp_ts *sign_ts, *rsl_ts;
 	struct e1inp_sign_link *oml_link, *rsl_link;
 
-	line = malloc(sizeof(*line));
+	line = talloc_zero(tall_bsc_ctx, struct e1inp_line);
 	if (!line)
-		return NULL;
-	memset(line, 0, sizeof(*line));
+		return -ENOMEM;
 
 	/* create E1 timeslots for signalling and TRAU frames */
 	e1inp_ts_config(&line->ts[1-1], line, E1INP_TS_TYPE_SIGN);
diff --git a/openbsc/src/e1_input.c b/openbsc/src/e1_input.c
index 034bd97..56bce01 100644
--- a/openbsc/src/e1_input.c
+++ b/openbsc/src/e1_input.c
@@ -51,6 +51,7 @@
 #include <openbsc/subchan_demux.h>
 #include <openbsc/trau_frame.h>
 #include <openbsc/trau_mux.h>
+#include <openbsc/talloc.h>
 
 #define NUM_E1_TS	32
 
@@ -60,6 +61,8 @@
 /* list of all E1 lines */
 LLIST_HEAD(e1inp_line_list);
 
+static void *tall_sigl_ctx;
+
 /* to be implemented, e.g. by bsc_hack.c */
 void input_event(int event, enum e1inp_sign_type type, struct gsm_bts_trx *trx);
 
@@ -366,12 +369,14 @@
 	if (ts->type != E1INP_TS_TYPE_SIGN)
 		return NULL;
 
-	link = malloc(sizeof(*link));
+	if (!tall_sigl_ctx)
+		tall_sigl_ctx = talloc_named_const(tall_bsc_ctx, 1,
+						   "e1inp_sign_link");
+
+	link = talloc_zero(tall_sigl_ctx, struct e1inp_sign_link);
 	if (!link)
 		return NULL;
 
-	memset(link, 0, sizeof(*link));
-
 	link->ts = ts;
 	link->type = type;
 	INIT_LLIST_HEAD(&link->tx_list);
@@ -451,7 +456,7 @@
 		}
 		break;
 	case E1INP_TS_TYPE_TRAU:
-		msg = msgb_alloc(TSX_ALLOC_SIZE);
+		msg = msgb_alloc(TSX_ALLOC_SIZE, "TRAU_TX");
 		if (!msg)
 			return NULL;
 		len = subchan_mux_out(&e1i_ts->trau.mux, msg->data, 40);
diff --git a/openbsc/src/gsm_04_08.c b/openbsc/src/gsm_04_08.c
index 8e5bfe8..6d8530b 100644
--- a/openbsc/src/gsm_04_08.c
+++ b/openbsc/src/gsm_04_08.c
@@ -44,6 +44,7 @@
 #include <openbsc/signal.h>
 #include <openbsc/trau_frame.h>
 #include <openbsc/trau_mux.h>
+#include <openbsc/talloc.h>
 
 #define GSM48_ALLOC_SIZE	1024
 #define GSM48_ALLOC_HEADROOM	128
@@ -52,6 +53,9 @@
 #define GSM_MAX_SSVERSION      128
 #define GSM_MAX_USERUSER       128
 
+static void *tall_locop_ctx;
+static void *tall_trans_ctx;
+
 static const struct tlv_definition rsl_att_tlvdef = {
 	.def = {
 		[GSM48_IE_MOBILE_ID]	= { TLV_TYPE_TLV },
@@ -337,7 +341,7 @@
 		return;
 
 	bsc_del_timer(&lchan->loc_operation->updating_timer);
-	free(lchan->loc_operation);
+	talloc_free(lchan->loc_operation);
 	lchan->loc_operation = 0;
 	put_lchan(lchan);
 }
@@ -347,9 +351,11 @@
 	use_lchan(lchan);
 	release_loc_updating_req(lchan);
 
-	lchan->loc_operation = (struct gsm_loc_updating_operation *)
-				malloc(sizeof(*lchan->loc_operation));
-	memset(lchan->loc_operation, 0, sizeof(*lchan->loc_operation));
+	if (!tall_locop_ctx)
+		tall_locop_ctx = talloc_named_const(tall_bsc_ctx, 1,
+						    "loc_updating_oper");
+	lchan->loc_operation = talloc_zero(tall_locop_ctx,
+					   struct gsm_loc_updating_operation);
 }
 
 static int gsm0408_authorize(struct gsm_lchan *lchan, struct msgb *msg)
@@ -380,6 +386,9 @@
 	 * operation taking place on the lchan.
 	 */
 	struct gsm_lchan *lchan = (struct gsm_lchan *)handler_data;
+	if (!lchan)
+		return 0;
+
 	release_loc_updating_req(lchan);
 
 	/* Free all transactions that are associated with the released lchan */
@@ -968,7 +977,8 @@
 
 struct msgb *gsm48_msgb_alloc(void)
 {
-	return msgb_alloc_headroom(GSM48_ALLOC_SIZE, GSM48_ALLOC_HEADROOM);
+	return msgb_alloc_headroom(GSM48_ALLOC_SIZE, GSM48_ALLOC_HEADROOM,
+				   "GSM 04.08");
 }
 
 int gsm48_sendmsg(struct msgb *msg)
@@ -1849,7 +1859,7 @@
 
 	mncc->msg_type = msg_type;
 	
-	msg = msgb_alloc(sizeof(struct gsm_mncc));
+	msg = msgb_alloc(sizeof(struct gsm_mncc), "MNCC");
 	if (!msg)
 		return -ENOMEM;
 	memcpy(msg->data, mncc, sizeof(struct gsm_mncc));
@@ -1911,7 +1921,7 @@
 
 	llist_del(&trans->entry);
 
-	free(trans);
+	talloc_free(trans);
 }
 
 static int gsm48_cc_tx_setup(struct gsm_trans *trans, void *arg);
@@ -1924,7 +1934,7 @@
 	struct gsm_subscriber *subscr = param;
 	struct gsm_trans *transt, *tmp;
 	struct gsm_network *net;
-  
+
 	if (hooknum != GSM_HOOK_RR_PAGING)
 		return -EINVAL;
   
@@ -2198,6 +2208,8 @@
 		setup.fields |= MNCC_F_CALLING;
 		strncpy(setup.calling.number, trans->subscr->extension,
 			sizeof(setup.calling.number)-1);
+		strncpy(setup.imsi, trans->subscr->imsi,
+			sizeof(setup.imsi)-1);
 	}
 	/* bearer capability */
 	if (TLVP_PRESENT(&tp, GSM48_IE_BEARER_CAP)) {
@@ -2536,6 +2548,8 @@
 		connect.fields |= MNCC_F_CONNECTED;
 		strncpy(connect.connected.number, trans->subscr->extension,
 			sizeof(connect.connected.number)-1);
+		strncpy(connect.imsi, trans->subscr->imsi,
+			sizeof(connect.imsi)-1);
 	}
 	/* facility */
 	if (TLVP_PRESENT(&tp, GSM48_IE_FACILITY)) {
@@ -3367,7 +3381,8 @@
 
 	/* Callref unknown */
 	if (!trans) {
-		if (msg_type != MNCC_SETUP_REQ || !data->called.number[0]) {
+		if (msg_type != MNCC_SETUP_REQ ||
+		    (!data->called.number[0] && !data->imsi[0])) {
 			DEBUGP(DCC, "(bts - trx - ts - ti -- sub %s) "
 				"Received '%s' from MNCC with "
 				"unknown callref %d\n", data->called.number,
@@ -3377,8 +3392,20 @@
 						GSM48_CAUSE_LOC_PRN_S_LU,
 						GSM48_CC_CAUSE_INVAL_TRANS_ID);
 		}
+		if (!data->called.number[0] && !data->imsi[0]) {
+			DEBUGP(DCC, "(bts - trx - ts - ti) "
+				"Received '%s' from MNCC with "
+				"no number or IMSI\n", get_mncc_name(msg_type));
+			/* Invalid number */
+			return mncc_release_ind(net, NULL, data->callref,
+						GSM48_CAUSE_LOC_PRN_S_LU,
+						GSM48_CC_CAUSE_INV_NR_FORMAT);
+		}
 		/* New transaction due to setup, find subscriber */
-		subscr = subscr_get_by_extension(data->called.number);
+		if (data->called.number[0])
+			subscr = subscr_get_by_extension(data->called.number);
+		else
+			subscr = subscr_get_by_imsi(data->imsi);
 		/* If subscriber is not found */
 		if (!subscr) {
 			DEBUGP(DCC, "(bts - trx - ts - ti -- sub %s) "
@@ -3403,7 +3430,7 @@
 						GSM48_CC_CAUSE_DEST_OOO);
 		}
 		/* Create transaction */
-		if (!(trans = calloc(1, sizeof(struct gsm_trans)))) {
+		if (!(trans = talloc_zero(tall_trans_ctx, struct gsm_trans))) {
 			DEBUGP(DCC, "No memory for trans.\n");
 			subscr_put(subscr);
 			/* Ressource unavailable */
@@ -3420,9 +3447,9 @@
 		trans->subscr = subscr;
 		/* Find lchan */
 		for (i = 0; i < net->num_bts; i++) {
-			bts = &net->bts[i];
+			bts = gsm_bts_num(net, i);
 			for (j = 0; j < bts->num_trx; j++) {
-				trx = &bts->trx[j];
+				trx = gsm_bts_trx_num(bts, j);
 				for (k = 0; k < TRX_NR_TS; k++) {
 					ts = &trx->ts[k];
 					for (l = 0; l < TS_MAX_LCHAN; l++) {
@@ -3609,7 +3636,7 @@
 		DEBUGP(DCC, "Unknown transaction ID %02x, "
 			"creating new trans.\n", transaction_id);
 		/* Create transaction */
-		if (!(trans = calloc(1, sizeof(struct gsm_trans)))) {
+		if (!(trans = talloc_zero(tall_trans_ctx, struct gsm_trans))) {
 			DEBUGP(DCC, "No memory for trans.\n");
 			rc = gsm48_tx_simple(msg->lchan,
 					     GSM48_PDISC_CC | transaction_id,
@@ -3784,6 +3811,7 @@
 			if (net->mncc_recv)
 				net->mncc_recv(net, mncc->msg_type, mncc);
 			work = 1; /* work done */
+			talloc_free(msg);
 		}
 
 	return work;
diff --git a/openbsc/src/gsm_04_11.c b/openbsc/src/gsm_04_11.c
index 3d5820d..1b622b1 100644
--- a/openbsc/src/gsm_04_11.c
+++ b/openbsc/src/gsm_04_11.c
@@ -41,13 +41,18 @@
 #include <openbsc/abis_rsl.h>
 #include <openbsc/signal.h>
 #include <openbsc/db.h>
+#include <openbsc/talloc.h>
 
 #define GSM411_ALLOC_SIZE	1024
 #define GSM411_ALLOC_HEADROOM	128
 
+static void *tall_sms_ctx;
+static void *tall_gsms_ctx;
+
 struct msgb *gsm411_msgb_alloc(void)
 {
-	return msgb_alloc_headroom(GSM411_ALLOC_SIZE, GSM411_ALLOC_HEADROOM);
+	return msgb_alloc_headroom(GSM411_ALLOC_SIZE, GSM411_ALLOC_HEADROOM,
+				   "GSM 04.11");
 }
 
 int gsm0411_sendmsg(struct msgb *msg)
@@ -139,8 +144,8 @@
 {
 	if (db_sms_store(gsms) != 0) {
 		DEBUGP(DSMS, "Failed to store SMS in Database\n");
-		free(sms);
-		free(gsms);
+		talloc_free(sms);
+		talloc_free(gsms);
 		return -EIO;
 	}
 	return 0;
@@ -156,14 +161,22 @@
 	u_int8_t address_lv[12]; /* according to 03.40 / 9.1.2.5 */
 	int rc = 0;
 
-	sms = malloc(sizeof(*sms));
+	if (!tall_sms_ctx)
+		tall_sms_ctx = talloc_named_const(tall_bsc_ctx, 1,
+						  "sms_submit");
+
+	sms = talloc(tall_sms_ctx, struct sms_submit);
 	if (!sms)
 		return -ENOMEM;
 	memset(sms, 0, sizeof(*sms));
 
-	gsms = malloc(sizeof(*gsms));
+	if (!tall_gsms_ctx)
+		tall_gsms_ctx = talloc_named_const(tall_bsc_ctx, 1,
+						   "sms");
+
+	gsms = talloc(tall_gsms_ctx, struct gsm_sms);
 	if (!gsms) {
-		free(sms);
+		talloc_free(sms);
 		return -ENOMEM;
 	}
 	memset(gsms, 0, sizeof(*gsms));
@@ -268,8 +281,8 @@
 	}
 
 out:
-	free(gsms);
-	free(sms);
+	talloc_free(gsms);
+	talloc_free(sms);
 
 	return rc;
 }
diff --git a/openbsc/src/gsm_data.c b/openbsc/src/gsm_data.c
index 80020e5..81facdf 100644
--- a/openbsc/src/gsm_data.c
+++ b/openbsc/src/gsm_data.c
@@ -25,6 +25,7 @@
 #include <errno.h>
 
 #include <openbsc/gsm_data.h>
+#include <openbsc/talloc.h>
 
 void set_ts_e1link(struct gsm_bts_trx_ts *ts, u_int8_t e1_nr,
 		   u_int8_t e1_ts, u_int8_t e1_ts_ss)
@@ -84,76 +85,124 @@
 	return chreq_names[c];
 }
 
-struct gsm_network *gsm_network_init(unsigned int num_bts, enum gsm_bts_type bts_type,
-				     u_int16_t country_code, u_int16_t network_code,
-				     int (*mncc_recv)(struct gsm_network *, int, void *))
+struct gsm_bts_trx *gsm_bts_trx_alloc(struct gsm_bts *bts)
 {
-	int i;
-	struct gsm_network *net;
+	struct gsm_bts_trx *trx = talloc(bts, struct gsm_bts_trx);
+	int k;
 
-	if (num_bts > GSM_MAX_BTS)
+	if (!trx)
 		return NULL;
 
-	net = malloc(sizeof(*net));
+	memset(trx, 0, sizeof(*trx));
+	trx->bts = bts;
+	trx->nr = bts->num_trx++;
+
+	for (k = 0; k < TRX_NR_TS; k++) {
+		struct gsm_bts_trx_ts *ts = &trx->ts[k];
+		int l;
+		
+		ts->trx = trx;
+		ts->nr = k;
+		ts->pchan = GSM_PCHAN_NONE;
+
+		for (l = 0; l < TS_MAX_LCHAN; l++) {
+			struct gsm_lchan *lchan;
+			lchan = &ts->lchan[l];
+
+			lchan->ts = ts;
+			lchan->nr = l;
+			lchan->type = GSM_LCHAN_NONE;
+		}
+	}
+
+	llist_add(&trx->list, &bts->trx_list);
+
+	return trx;
+}
+
+struct gsm_bts *gsm_bts_alloc(struct gsm_network *net, enum gsm_bts_type type,
+			      u_int8_t tsc, u_int8_t bsic)
+{
+	struct gsm_bts *bts = talloc(net, struct gsm_bts);
+
+	if (!bts)
+		return NULL;
+
+	memset(bts, 0, sizeof(*bts));
+	bts->network = net;
+	bts->nr = net->num_bts++;
+	bts->type = type;
+	bts->tsc = tsc;
+	bts->bsic = bsic;
+	bts->num_trx = 0;
+	INIT_LLIST_HEAD(&bts->trx_list);
+
+	/* create our primary TRX */
+	bts->c0 = gsm_bts_trx_alloc(bts);
+	if (!bts->c0) {
+		talloc_free(bts);
+		return NULL;
+	}
+	bts->c0->ts[0].pchan = GSM_PCHAN_CCCH_SDCCH4;
+
+	llist_add(&bts->list, &net->bts_list);
+
+	return bts;
+}
+
+struct gsm_network *gsm_network_init(u_int16_t country_code, u_int16_t network_code,
+				     int (*mncc_recv)(struct gsm_network *, int, void *))
+{
+	struct gsm_network *net;
+
+	net = talloc(tall_bsc_ctx, struct gsm_network);
 	if (!net)
 		return NULL;
 	memset(net, 0, sizeof(*net));	
 
 	net->country_code = country_code;
 	net->network_code = network_code;
-	net->num_bts = num_bts;
+	net->num_bts = 0;
 
 	INIT_LLIST_HEAD(&net->trans_list);
 	INIT_LLIST_HEAD(&net->upqueue);
+	INIT_LLIST_HEAD(&net->bts_list);
 
 	net->mncc_recv = mncc_recv;
 
-	for (i = 0; i < num_bts; i++) {
-		struct gsm_bts *bts = &net->bts[i];
-		int j;
-		
-		bts->network = net;
-		bts->nr = i;
-		bts->type = bts_type;
-		bts->tsc = HARDCODED_TSC;
-		bts->bsic = HARDCODED_BSIC;
-
-		for (j = 0; j < BTS_MAX_TRX; j++) {
-			struct gsm_bts_trx *trx = &bts->trx[j];
-			int k;
-
-			trx->bts = bts;
-			trx->nr = j;
-
-			for (k = 0; k < TRX_NR_TS; k++) {
-				struct gsm_bts_trx_ts *ts = &trx->ts[k];
-				int l;
-				
-				ts->trx = trx;
-				ts->nr = k;
-				ts->pchan = GSM_PCHAN_NONE;
-
-				for (l = 0; l < TS_MAX_LCHAN; l++) {
-					struct gsm_lchan *lchan;
-					lchan = &ts->lchan[l];
-
-					lchan->ts = ts;
-					lchan->nr = l;
-					lchan->type = GSM_LCHAN_NONE;
-				}
-			}
-		}
-
-		bts->num_trx = 1;	/* FIXME */
-#ifdef HAVE_TRX1
-		bts->num_trx++;
-#endif
-		bts->c0 = &bts->trx[0];
-		bts->c0->ts[0].pchan = GSM_PCHAN_CCCH_SDCCH4;
-	}
 	return net;
 }
 
+struct gsm_bts *gsm_bts_num(struct gsm_network *net, int num)
+{
+	struct gsm_bts *bts;
+
+	if (num >= net->num_bts)
+		return NULL;
+
+	llist_for_each_entry(bts, &net->bts_list, list) {
+		if (bts->nr == num)
+			return bts;
+	}
+
+	return NULL;
+}
+
+struct gsm_bts_trx *gsm_bts_trx_num(struct gsm_bts *bts, int num)
+{
+	struct gsm_bts_trx *trx;
+
+	if (num >= bts->num_trx)
+		return NULL;
+
+	llist_for_each_entry(trx, &bts->trx_list, list) {
+		if (trx->nr == num)
+			return trx;
+	}
+
+	return NULL;
+}
+
 static char ts2str[255];
 
 char *gsm_ts_name(struct gsm_bts_trx_ts *ts)
@@ -201,7 +250,7 @@
 		skip = 1;
 
 	for (i = 0; i < net->num_bts; i++) {
-		bts = &net->bts[i];
+		bts = gsm_bts_num(net, i);
 
 		if (skip) {
 			if (start_bts == bts)
diff --git a/openbsc/src/gsm_subscriber.c b/openbsc/src/gsm_subscriber.c
index 3062a6b..a323d4e 100644
--- a/openbsc/src/gsm_subscriber.c
+++ b/openbsc/src/gsm_subscriber.c
@@ -27,6 +27,7 @@
 #include <string.h>
 #include <assert.h>
 
+#include <openbsc/talloc.h>
 #include <openbsc/gsm_subscriber.h>
 #include <openbsc/paging.h>
 #include <openbsc/debug.h>
@@ -34,6 +35,8 @@
 #include <openbsc/db.h>
 
 LLIST_HEAD(active_subscribers);
+static void *tall_subscr_ctx;
+static void *tall_sub_req_ctx;
 
 /*
  * Struct for pending channel requests. This is managed in the
@@ -82,7 +85,7 @@
 	request->cbfn(hooknum, event, msg, data, request->param);
 	subscr->in_callback = 0;
 
-	free(request);
+	talloc_free(request);
 	return 0;
 }
 
@@ -100,7 +103,11 @@
 {
 	struct gsm_subscriber *s;
 
-	s = malloc(sizeof(struct gsm_subscriber));
+	if (!tall_subscr_ctx)
+		tall_subscr_ctx = talloc_named_const(tall_bsc_ctx, 1,
+						     "subscriber");
+
+	s = talloc(tall_subscr_ctx, struct gsm_subscriber);
 	if (!s)
 		return NULL;
 
@@ -116,7 +123,7 @@
 static void subscr_free(struct gsm_subscriber *subscr)
 {
 	llist_del(&subscr->entry);
-	free(subscr);
+	talloc_free(subscr);
 }
 
 struct gsm_subscriber *subscr_get_by_tmsi(const char *tmsi)
@@ -202,7 +209,11 @@
 {
 	struct subscr_request *request;
 
-	request = (struct subscr_request *)malloc(sizeof(*request));
+	if (!tall_sub_req_ctx)
+		tall_sub_req_ctx = talloc_named_const(tall_bsc_ctx, 1,
+						      "subscr_request");
+
+	request = talloc(tall_sub_req_ctx, struct subscr_request);
 	if (!request) {
 		if (cbfn)
 			cbfn(GSM_HOOK_RR_PAGING, GSM_PAGING_OOM,
diff --git a/openbsc/src/input/ipaccess.c b/openbsc/src/input/ipaccess.c
index ea7f847..cee53cc 100644
--- a/openbsc/src/input/ipaccess.c
+++ b/openbsc/src/input/ipaccess.c
@@ -42,6 +42,7 @@
 #include <openbsc/subchan_demux.h>
 #include <openbsc/e1_input.h>
 #include <openbsc/ipaccess.h>
+#include <openbsc/talloc.h>
 
 /* data structure for one E1 interface with A-bis */
 struct ia_e1_handle {
@@ -111,10 +112,10 @@
 struct gsm_bts *find_bts_by_unitid(struct gsm_network *net,
 				   u_int16_t site_id, u_int16_t bts_id)
 {
+	struct gsm_bts *bts;
 	int i;
 
-	for (i = 0; i < net->num_bts; i++) {
-		struct gsm_bts *bts = &net->bts[i];
+	llist_for_each_entry(bts, &net->bts_list, list) {
 
 		if (!is_ipaccess_bts(bts))
 			continue;
@@ -222,7 +223,7 @@
 			memcpy(newbfd, bfd, sizeof(*newbfd));
 			bsc_unregister_fd(bfd);
 			bsc_register_fd(newbfd);
-			free(bfd);
+			talloc_free(bfd);
 		}
 		break;
 	case IPAC_MSGT_ID_ACK:
@@ -243,7 +244,7 @@
 	unsigned int ts_nr = bfd->priv_nr;
 	struct e1inp_ts *e1i_ts = &line->ts[ts_nr-1];
 	struct e1inp_sign_link *link;
-	struct msgb *msg = msgb_alloc(TS1_ALLOC_SIZE);
+	struct msgb *msg = msgb_alloc(TS1_ALLOC_SIZE, "Abis/IP");
 	struct ipaccess_head *hh;
 	int ret;
 
@@ -429,7 +430,7 @@
 	}
 	DEBUGP(DINP, "accept()ed new OML link from %s\n", inet_ntoa(sa.sin_addr));
 
-	line = malloc(sizeof(*line));
+	line = talloc(tall_bsc_ctx, struct e1inp_line);
 	if (!line) {
 		close(ret);
 		return -ENOMEM;
@@ -453,7 +454,7 @@
 	if (ret < 0) {
 		fprintf(stderr, "could not register FD\n");
 		close(bfd->fd);
-		free(line);
+		talloc_free(line);
 		return ret;
 	}
 
@@ -467,12 +468,17 @@
 {
 	struct sockaddr_in sa;
 	socklen_t sa_len = sizeof(sa);
-	struct bsc_fd *bfd = malloc(sizeof(*bfd));
+	struct bsc_fd *bfd;
 	int ret;
 
 	if (!(what & BSC_FD_READ))
 		return 0;
 
+	bfd = talloc(tall_bsc_ctx, struct bsc_fd);
+	if (!bfd)
+		return -ENOMEM;
+	memset(bfd, 0, sizeof(*bfd));
+
 	/* Some BTS has connected to us, but we don't know yet which line
 	 * (as created by the OML link) to associate it with.  Thus, we
 	 * aloocate a temporary bfd until we have received ID from BTS */
@@ -490,7 +496,7 @@
 	if (ret < 0) {
 		fprintf(stderr, "could not register FD\n");
 		close(bfd->fd);
-		free(bfd);
+		talloc_free(bfd);
 		return ret;
 	}
 	/* Request ID. FIXME: request LOCATION, HW/SW VErsion, Unit Name, Serno */
@@ -581,8 +587,11 @@
 	if (ret)
 		return ret;
 
-	e1h = malloc(sizeof(*e1h));
+	e1h = talloc(tall_bsc_ctx, struct ia_e1_handle);
+	if (!e1h)
+		return -ENOMEM;
 	memset(e1h, 0, sizeof(*e1h));
+
 	e1h->gsmnet = gsmnet;
 
 	/* Listen for OML connections */
diff --git a/openbsc/src/input/misdn.c b/openbsc/src/input/misdn.c
index de8d41f..367d8e4 100644
--- a/openbsc/src/input/misdn.c
+++ b/openbsc/src/input/misdn.c
@@ -47,6 +47,7 @@
 #include <openbsc/abis_rsl.h>
 #include <openbsc/subchan_demux.h>
 #include <openbsc/e1_input.h>
+#include <openbsc/talloc.h>
 
 /* data structure for one E1 interface with A-bis */
 struct mi_e1_handle {
@@ -95,7 +96,7 @@
 	unsigned int ts_nr = bfd->priv_nr;
 	struct e1inp_ts *e1i_ts = &line->ts[ts_nr-1];
 	struct e1inp_sign_link *link;
-	struct msgb *msg = msgb_alloc(TS1_ALLOC_SIZE);
+	struct msgb *msg = msgb_alloc(TS1_ALLOC_SIZE, "mISDN TS1");
 	struct sockaddr_mISDN l2addr;
 	struct mISDNhead *hh;
 	socklen_t alen;
@@ -136,7 +137,7 @@
 		link = e1inp_lookup_sign_link(e1i_ts, l2addr.tei, l2addr.sapi);
 		if (!link) {
 			DEBUGPC(DMI, "mISDN message for unknown sign_link\n");
-			free(msg);
+			msgb_free(msg);
 			return -EINVAL;
 		}
 		/* save the channel number in the driver private struct */
@@ -277,7 +278,7 @@
 	struct e1inp_line *line = bfd->data;
 	unsigned int ts_nr = bfd->priv_nr;
 	struct e1inp_ts *e1i_ts = &line->ts[ts_nr-1];
-	struct msgb *msg = msgb_alloc(TSX_ALLOC_SIZE);
+	struct msgb *msg = msgb_alloc(TSX_ALLOC_SIZE, "mISDN TSx");
 	struct mISDNhead *hh;
 	int ret;
 
@@ -483,7 +484,7 @@
 
 	/* create the actual line instance */
 	/* FIXME: do this independent of driver registration */
-	e1h = malloc(sizeof(*e1h));
+	e1h = talloc(tall_bsc_ctx, struct mi_e1_handle);
 	memset(e1h, 0, sizeof(*e1h));
 
 	e1h->cardnr = cardnr;
diff --git a/openbsc/src/ipaccess-config.c b/openbsc/src/ipaccess-config.c
index cc8a6c9..d3f3176 100644
--- a/openbsc/src/ipaccess-config.c
+++ b/openbsc/src/ipaccess-config.c
@@ -170,11 +170,12 @@
 		exit(2);
 	}
 
-	gsmnet = gsm_network_init(1, GSM_BTS_TYPE_NANOBTS_900, 1, 1, NULL);
+	gsmnet = gsm_network_init(1, 1, NULL);
 	if (!gsmnet)
 		exit(1);
 
-	bts = &gsmnet->bts[0];
+	bts = gsm_bts_alloc(gsmnet, GSM_BTS_TYPE_NANOBTS_900, HARDCODED_TSC,
+				HARDCODED_BSIC);
 	
 	printf("Trying to connect to ip.access BTS ...\n");
 
diff --git a/openbsc/src/mncc.c b/openbsc/src/mncc.c
index 4282aaf..b2dab07 100644
--- a/openbsc/src/mncc.c
+++ b/openbsc/src/mncc.c
@@ -27,6 +27,10 @@
 #include <openbsc/gsm_04_08.h>
 #include <openbsc/debug.h>
 #include <openbsc/mncc.h>
+#include <openbsc/talloc.h>
+#include <openbsc/gsm_data.h>
+
+static void *tall_call_ctx;
 
 static struct mncc_names {
 	char *name;
@@ -103,7 +107,7 @@
 {
 	llist_del(&call->entry);
 	DEBUGP(DMNCC, "(call %x) Call removed.\n", call->callref);
-	free(call);
+	talloc_free(call);
 }
 
 
@@ -136,8 +140,11 @@
 	if (call->remote_ref)
 		return 0;
 	
+	if (!tall_call_ctx)
+		tall_call_ctx = talloc_named_const(tall_bsc_ctx, 1,
+							   "gsm_call");
 	/* create remote call */
-	if (!(remote = calloc(1, sizeof(struct gsm_call)))) {
+	if (!(remote = talloc(tall_call_ctx, struct gsm_call))) {
 		memset(&mncc, 0, sizeof(struct gsm_mncc));
 		mncc.callref = call->callref;
 		mncc_set_cause(&mncc, GSM48_CAUSE_LOC_PRN_S_LU,
@@ -299,8 +306,11 @@
 	if (!call) {
 		if (msg_type != MNCC_SETUP_IND)
 			return 0; /* drop */
+		if (!tall_call_ctx)
+			tall_call_ctx = talloc_named_const(tall_bsc_ctx, 1,
+							   "gsm_call");
 		/* create call */
-		if (!(call = calloc(1, sizeof(struct gsm_call)))) {
+		if (!(call = talloc_zero(tall_call_ctx, struct gsm_call))) {
 			struct gsm_mncc rel;
 			
 			memset(&rel, 0, sizeof(struct gsm_mncc));
diff --git a/openbsc/src/msgb.c b/openbsc/src/msgb.c
index ce390e8..ae13346 100644
--- a/openbsc/src/msgb.c
+++ b/openbsc/src/msgb.c
@@ -24,14 +24,22 @@
 #include <sys/types.h>
 
 #include <openbsc/msgb.h>
+#include <openbsc/gsm_data.h>
+#include <openbsc/talloc.h>
 
-struct msgb *msgb_alloc(u_int16_t size)
+static void *tall_msgb_ctx;
+
+struct msgb *msgb_alloc(u_int16_t size, const char *name)
 {
-	struct msgb *msg = malloc(sizeof(*msg) + size);
+	struct msgb *msg;
+
+	if (!tall_msgb_ctx)
+		tall_msgb_ctx = talloc_named_const(tall_bsc_ctx, 1, "msgb");
+
+	msg = _talloc_zero(tall_msgb_ctx, sizeof(*msg) + size, name);
 
 	if (!msg)
 		return NULL;
-	memset(msg, 0, sizeof(*msg)+size);
 
 	msg->data_len = size;
 	msg->len = 0;
@@ -48,7 +56,7 @@
 
 void msgb_free(struct msgb *m)
 {
-	free(m);
+	talloc_free(m);
 }
 
 void msgb_enqueue(struct llist_head *queue, struct msgb *msg)
diff --git a/openbsc/src/paging.c b/openbsc/src/paging.c
index 53e5146..0703e93 100644
--- a/openbsc/src/paging.c
+++ b/openbsc/src/paging.c
@@ -40,6 +40,7 @@
 #include <assert.h>
 
 #include <openbsc/paging.h>
+#include <openbsc/talloc.h>
 #include <openbsc/debug.h>
 #include <openbsc/signal.h>
 #include <openbsc/abis_rsl.h>
@@ -48,6 +49,8 @@
 #define PAGING_TIMEOUT 1, 75000
 #define MAX_PAGING_REQUEST 750
 
+static void *tall_paging_ctx;
+
 static unsigned int calculate_group(struct gsm_bts *bts, struct gsm_subscriber *subscr)
 {
 	int ccch_conf;
@@ -81,7 +84,7 @@
 	bsc_del_timer(&to_be_deleted->T3113);
 	llist_del(&to_be_deleted->entry);
 	subscr_put(to_be_deleted->subscr);
-	free(to_be_deleted);
+	talloc_free(to_be_deleted);
 }
 
 static void page_ms(struct gsm_paging_request *request)
@@ -216,14 +219,16 @@
 	struct gsm_bts_paging_state *bts_entry = &bts->paging;
 	struct gsm_paging_request *req;
 
+	if (!tall_paging_ctx)
+		tall_paging_ctx = talloc_named_const(NULL, 1, "paging_request");
+
 	if (paging_pending_request(bts_entry, subscr)) {
 		DEBUGP(DPAG, "Paging request already pending\n");
 		return;
 	}
 
 	DEBUGP(DPAG, "Start paging on bts %d.\n", bts->nr);
-	req = (struct gsm_paging_request *)malloc(sizeof(*req));
-	memset(req, 0, sizeof(*req));
+	req = talloc_zero(tall_paging_ctx, struct gsm_paging_request);
 	req->subscr = subscr_get(subscr);
 	req->bts = bts;
 	req->chan_type = type;
diff --git a/openbsc/src/rs232.c b/openbsc/src/rs232.c
index 2a64de5..a584723 100644
--- a/openbsc/src/rs232.c
+++ b/openbsc/src/rs232.c
@@ -127,7 +127,7 @@
 	int rc = 0;
 
 	if (!sh->rx_msg) {
-		sh->rx_msg = msgb_alloc(SERIAL_ALLOC_SIZE);
+		sh->rx_msg = msgb_alloc(SERIAL_ALLOC_SIZE, "RS232 Rx");
 		sh->rx_msg->l2h = NULL;
 		sh->rx_msg->trx = sh->bts->c0;
 	}
diff --git a/openbsc/src/signal.c b/openbsc/src/signal.c
index 4227c6d..41352fb 100644
--- a/openbsc/src/signal.c
+++ b/openbsc/src/signal.c
@@ -19,10 +19,12 @@
  */
 
 #include <openbsc/signal.h>
+#include <openbsc/talloc.h>
 #include <stdlib.h>
 #include <string.h>
 
 
+static void *tall_sigh_ctx;
 static LLIST_HEAD(signal_handler_list);
 
 struct signal_handler {
@@ -35,8 +37,12 @@
 
 int register_signal_handler(unsigned int subsys, signal_cbfn *cbfn, void *data)
 {
-	struct signal_handler *sig_data = malloc(sizeof(*sig_data));
+	struct signal_handler *sig_data;
 
+	if (!tall_sigh_ctx)
+		tall_sigh_ctx = talloc_named_const(NULL, 1, "signal_handler");
+
+	sig_data = talloc(tall_sigh_ctx, struct signal_handler);
 	if (!sig_data)
 		return -ENOMEM;
 
@@ -61,7 +67,7 @@
 		if (handler->cbfn == cbfn && handler->data == data 
 		    && subsys == handler->subsys) {
 			llist_del(&handler->entry);
-			free(handler);
+			talloc_free(handler);
 			break;
 		}
 	}
diff --git a/openbsc/src/subchan_demux.c b/openbsc/src/subchan_demux.c
index c662bcd..ccd4fad 100644
--- a/openbsc/src/subchan_demux.c
+++ b/openbsc/src/subchan_demux.c
@@ -28,6 +28,10 @@
 #include <openbsc/subchan_demux.h>
 #include <openbsc/trau_frame.h>
 #include <openbsc/debug.h>
+#include <openbsc/talloc.h>
+#include <openbsc/gsm_data.h>
+
+static void *tall_tqe_ctx;
 
 static inline void append_bit(struct demux_subch *sch, u_int8_t bit)
 {
@@ -201,7 +205,7 @@
 		/* free the tx_queue entry if it is fully consumed */
 		if (txe->next_bit >= txe->bit_len) {
 			llist_del(&txe->list);
-			free(txe);
+			talloc_free(txe);
 		}
 
 		/* increment global number of bits dequeued */
@@ -277,7 +281,7 @@
 
 		tqe = llist_entry(sch->tx_queue.next, struct subch_txq_entry, list);
 		llist_del(&tqe->list);
-		free(tqe);
+		talloc_free(tqe);
 	}
 }
 
@@ -286,13 +290,12 @@
 			int len)
 {
 	struct mux_subch *sch = &mx->subch[s_nr];
-	struct subch_txq_entry *tqe = malloc(sizeof(*tqe) + len);
 	int list_len = llist_len(&sch->tx_queue);
-
+	struct subch_txq_entry *tqe = talloc_zero_size(tall_tqe_ctx,
+							sizeof(*tqe) + len);
 	if (!tqe)
 		return -ENOMEM;
 
-	memset(tqe, 0, sizeof(*tqe));
 	tqe->bit_len = len;
 	memcpy(tqe->bits, data, len);
 
@@ -309,6 +312,9 @@
 {
 	int i;
 
+	if (!tall_tqe_ctx)
+		tall_tqe_ctx = talloc_named_const(tall_bsc_ctx, 1,
+						  "subch_txq_entry");
 	memset(mx, 0, sizeof(*mx));
 	for (i = 0; i < NR_SUBCH; i++) {
 		struct mux_subch *sch = &mx->subch[i];
diff --git a/openbsc/src/talloc.c b/openbsc/src/talloc.c
new file mode 100644
index 0000000..bd5e1b0
--- /dev/null
+++ b/openbsc/src/talloc.c
@@ -0,0 +1,1796 @@
+/* 
+   Samba Unix SMB/CIFS implementation.
+
+   Samba trivial allocation library - new interface
+
+   NOTE: Please read talloc_guide.txt for full documentation
+
+   Copyright (C) Andrew Tridgell 2004
+   Copyright (C) Stefan Metzmacher 2006
+   
+     ** NOTE! The following LGPL license applies to the talloc
+     ** library. This does NOT imply that all of Samba is released
+     ** under the LGPL
+   
+   This library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 3 of the License, or (at your option) any later version.
+
+   This library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with this library; if not, see <http://www.gnu.org/licenses/>.
+*/
+
+/*
+  inspired by http://swapped.cc/halloc/
+*/
+
+#ifdef _SAMBA_BUILD_
+#include "version.h"
+#if (SAMBA_VERSION_MAJOR<4)
+#include "includes.h"
+/* This is to circumvent SAMBA3's paranoid malloc checker. Here in this file
+ * we trust ourselves... */
+#ifdef malloc
+#undef malloc
+#endif
+#ifdef realloc
+#undef realloc
+#endif
+#define _TALLOC_SAMBA3
+#endif /* (SAMBA_VERSION_MAJOR<4) */
+#endif /* _SAMBA_BUILD_ */
+
+#ifndef _TALLOC_SAMBA3
+//#include "replace.h"
+#include <sys/types.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <stdbool.h>
+#define __USE_GNU
+#include <string.h>
+#undef __USE_GNU
+#include <openbsc/talloc.h>
+#define MIN(x,y) ((x) < (y) ? (x) : (y))
+#endif /* not _TALLOC_SAMBA3 */
+
+/* use this to force every realloc to change the pointer, to stress test
+   code that might not cope */
+#define ALWAYS_REALLOC 0
+
+
+#define MAX_TALLOC_SIZE 0x10000000
+#define TALLOC_MAGIC 0xe814ec70
+#define TALLOC_FLAG_FREE 0x01
+#define TALLOC_FLAG_LOOP 0x02
+#define TALLOC_FLAG_POOL 0x04		/* This is a talloc pool */
+#define TALLOC_FLAG_POOLMEM 0x08	/* This is allocated in a pool */
+#define TALLOC_MAGIC_REFERENCE ((const char *)1)
+
+/* by default we abort when given a bad pointer (such as when talloc_free() is called 
+   on a pointer that came from malloc() */
+#ifndef TALLOC_ABORT
+#define TALLOC_ABORT(reason) abort()
+#endif
+
+#ifndef discard_const_p
+#if defined(__intptr_t_defined) || defined(HAVE_INTPTR_T)
+# define discard_const_p(type, ptr) ((type *)((intptr_t)(ptr)))
+#else
+# define discard_const_p(type, ptr) ((type *)(ptr))
+#endif
+#endif
+
+/* these macros gain us a few percent of speed on gcc */
+#if (__GNUC__ >= 3)
+/* the strange !! is to ensure that __builtin_expect() takes either 0 or 1
+   as its first argument */
+#ifndef likely
+#define likely(x)   __builtin_expect(!!(x), 1)
+#endif
+#ifndef unlikely
+#define unlikely(x) __builtin_expect(!!(x), 0)
+#endif
+#else
+#ifndef likely
+#define likely(x) (x)
+#endif
+#ifndef unlikely
+#define unlikely(x) (x)
+#endif
+#endif
+
+/* this null_context is only used if talloc_enable_leak_report() or
+   talloc_enable_leak_report_full() is called, otherwise it remains
+   NULL
+*/
+static void *null_context;
+static void *autofree_context;
+
+struct talloc_reference_handle {
+	struct talloc_reference_handle *next, *prev;
+	void *ptr;
+};
+
+typedef int (*talloc_destructor_t)(void *);
+
+struct talloc_chunk {
+	struct talloc_chunk *next, *prev;
+	struct talloc_chunk *parent, *child;
+	struct talloc_reference_handle *refs;
+	talloc_destructor_t destructor;
+	const char *name;
+	size_t size;
+	unsigned flags;
+
+	/*
+	 * "pool" has dual use:
+	 *
+	 * For the talloc pool itself (i.e. TALLOC_FLAG_POOL is set), "pool"
+	 * marks the end of the currently allocated area.
+	 *
+	 * For members of the pool (i.e. TALLOC_FLAG_POOLMEM is set), "pool"
+	 * is a pointer to the struct talloc_chunk of the pool that it was
+	 * allocated from. This way children can quickly find the pool to chew
+	 * from.
+	 */
+	void *pool;
+};
+
+/* 16 byte alignment seems to keep everyone happy */
+#define TC_HDR_SIZE ((sizeof(struct talloc_chunk)+15)&~15)
+#define TC_PTR_FROM_CHUNK(tc) ((void *)(TC_HDR_SIZE + (char*)tc))
+
+static void (*talloc_abort_fn)(const char *reason);
+
+void talloc_set_abort_fn(void (*abort_fn)(const char *reason))
+{
+	talloc_abort_fn = abort_fn;
+}
+
+static void talloc_abort(const char *reason)
+{
+	if (!talloc_abort_fn) {
+		TALLOC_ABORT(reason);
+	}
+
+	talloc_abort_fn(reason);
+}
+
+static void talloc_abort_double_free(void)
+{
+	talloc_abort("Bad talloc magic value - double free");
+}
+
+static void talloc_abort_unknown_value(void)
+{
+	talloc_abort("Bad talloc magic value - unknown value");
+}
+
+/* panic if we get a bad magic value */
+static inline struct talloc_chunk *talloc_chunk_from_ptr(const void *ptr)
+{
+	const char *pp = (const char *)ptr;
+	struct talloc_chunk *tc = discard_const_p(struct talloc_chunk, pp - TC_HDR_SIZE);
+	if (unlikely((tc->flags & (TALLOC_FLAG_FREE | ~0xF)) != TALLOC_MAGIC)) { 
+		if (tc->flags & TALLOC_FLAG_FREE) {
+			talloc_abort_double_free();
+		} else {
+			talloc_abort_unknown_value();
+		}
+	}
+	return tc;
+}
+
+/* hook into the front of the list */
+#define _TLIST_ADD(list, p) \
+do { \
+        if (!(list)) { \
+		(list) = (p); \
+		(p)->next = (p)->prev = NULL; \
+	} else { \
+		(list)->prev = (p); \
+		(p)->next = (list); \
+		(p)->prev = NULL; \
+		(list) = (p); \
+	}\
+} while (0)
+
+/* remove an element from a list - element doesn't have to be in list. */
+#define _TLIST_REMOVE(list, p) \
+do { \
+	if ((p) == (list)) { \
+		(list) = (p)->next; \
+		if (list) (list)->prev = NULL; \
+	} else { \
+		if ((p)->prev) (p)->prev->next = (p)->next; \
+		if ((p)->next) (p)->next->prev = (p)->prev; \
+	} \
+	if ((p) && ((p) != (list))) (p)->next = (p)->prev = NULL; \
+} while (0)
+
+
+/*
+  return the parent chunk of a pointer
+*/
+static inline struct talloc_chunk *talloc_parent_chunk(const void *ptr)
+{
+	struct talloc_chunk *tc;
+
+	if (unlikely(ptr == NULL)) {
+		return NULL;
+	}
+
+	tc = talloc_chunk_from_ptr(ptr);
+	while (tc->prev) tc=tc->prev;
+
+	return tc->parent;
+}
+
+void *talloc_parent(const void *ptr)
+{
+	struct talloc_chunk *tc = talloc_parent_chunk(ptr);
+	return tc? TC_PTR_FROM_CHUNK(tc) : NULL;
+}
+
+/*
+  find parents name
+*/
+const char *talloc_parent_name(const void *ptr)
+{
+	struct talloc_chunk *tc = talloc_parent_chunk(ptr);
+	return tc? tc->name : NULL;
+}
+
+/*
+  A pool carries an in-pool object count count in the first 16 bytes.
+  bytes. This is done to support talloc_steal() to a parent outside of the
+  pool. The count includes the pool itself, so a talloc_free() on a pool will
+  only destroy the pool if the count has dropped to zero. A talloc_free() of a
+  pool member will reduce the count, and eventually also call free(3) on the
+  pool memory.
+
+  The object count is not put into "struct talloc_chunk" because it is only
+  relevant for talloc pools and the alignment to 16 bytes would increase the
+  memory footprint of each talloc chunk by those 16 bytes.
+*/
+
+#define TALLOC_POOL_HDR_SIZE 16
+
+static unsigned int *talloc_pool_objectcount(struct talloc_chunk *tc)
+{
+	return (unsigned int *)((char *)tc + sizeof(struct talloc_chunk));
+}
+
+/*
+  Allocate from a pool
+*/
+
+static struct talloc_chunk *talloc_alloc_pool(struct talloc_chunk *parent,
+					      size_t size)
+{
+	struct talloc_chunk *pool_ctx = NULL;
+	size_t space_left;
+	struct talloc_chunk *result;
+	size_t chunk_size;
+
+	if (parent == NULL) {
+		return NULL;
+	}
+
+	if (parent->flags & TALLOC_FLAG_POOL) {
+		pool_ctx = parent;
+	}
+	else if (parent->flags & TALLOC_FLAG_POOLMEM) {
+		pool_ctx = (struct talloc_chunk *)parent->pool;
+	}
+
+	if (pool_ctx == NULL) {
+		return NULL;
+	}
+
+	space_left = ((char *)pool_ctx + TC_HDR_SIZE + pool_ctx->size)
+		- ((char *)pool_ctx->pool);
+
+	/*
+	 * Align size to 16 bytes
+	 */
+	chunk_size = ((size + 15) & ~15);
+
+	if (space_left < chunk_size) {
+		return NULL;
+	}
+
+	result = (struct talloc_chunk *)pool_ctx->pool;
+
+#if defined(DEVELOPER) && defined(VALGRIND_MAKE_MEM_UNDEFINED)
+	VALGRIND_MAKE_MEM_UNDEFINED(result, size);
+#endif
+
+	pool_ctx->pool = (void *)((char *)result + chunk_size);
+
+	result->flags = TALLOC_MAGIC | TALLOC_FLAG_POOLMEM;
+	result->pool = pool_ctx;
+
+	*talloc_pool_objectcount(pool_ctx) += 1;
+
+	return result;
+}
+
+/* 
+   Allocate a bit of memory as a child of an existing pointer
+*/
+static inline void *__talloc(const void *context, size_t size)
+{
+	struct talloc_chunk *tc = NULL;
+
+	if (unlikely(context == NULL)) {
+		context = null_context;
+	}
+
+	if (unlikely(size >= MAX_TALLOC_SIZE)) {
+		return NULL;
+	}
+
+	if (context != NULL) {
+		tc = talloc_alloc_pool(talloc_chunk_from_ptr(context),
+				       TC_HDR_SIZE+size);
+	}
+
+	if (tc == NULL) {
+		tc = (struct talloc_chunk *)malloc(TC_HDR_SIZE+size);
+		if (unlikely(tc == NULL)) return NULL;
+		tc->flags = TALLOC_MAGIC;
+		tc->pool  = NULL;
+	}
+
+	tc->size = size;
+	tc->destructor = NULL;
+	tc->child = NULL;
+	tc->name = NULL;
+	tc->refs = NULL;
+
+	if (likely(context)) {
+		struct talloc_chunk *parent = talloc_chunk_from_ptr(context);
+
+		if (parent->child) {
+			parent->child->parent = NULL;
+			tc->next = parent->child;
+			tc->next->prev = tc;
+		} else {
+			tc->next = NULL;
+		}
+		tc->parent = parent;
+		tc->prev = NULL;
+		parent->child = tc;
+	} else {
+		tc->next = tc->prev = tc->parent = NULL;
+	}
+
+	return TC_PTR_FROM_CHUNK(tc);
+}
+
+/*
+ * Create a talloc pool
+ */
+
+void *talloc_pool(const void *context, size_t size)
+{
+	void *result = __talloc(context, size + TALLOC_POOL_HDR_SIZE);
+	struct talloc_chunk *tc;
+
+	if (unlikely(result == NULL)) {
+		return NULL;
+	}
+
+	tc = talloc_chunk_from_ptr(result);
+
+	tc->flags |= TALLOC_FLAG_POOL;
+	tc->pool = (char *)result + TALLOC_POOL_HDR_SIZE;
+
+	*talloc_pool_objectcount(tc) = 1;
+
+#if defined(DEVELOPER) && defined(VALGRIND_MAKE_MEM_NOACCESS)
+	VALGRIND_MAKE_MEM_NOACCESS(tc->pool, size);
+#endif
+
+	return result;
+}
+
+/*
+  setup a destructor to be called on free of a pointer
+  the destructor should return 0 on success, or -1 on failure.
+  if the destructor fails then the free is failed, and the memory can
+  be continued to be used
+*/
+void _talloc_set_destructor(const void *ptr, int (*destructor)(void *))
+{
+	struct talloc_chunk *tc = talloc_chunk_from_ptr(ptr);
+	tc->destructor = destructor;
+}
+
+/*
+  increase the reference count on a piece of memory. 
+*/
+int talloc_increase_ref_count(const void *ptr)
+{
+	if (unlikely(!talloc_reference(null_context, ptr))) {
+		return -1;
+	}
+	return 0;
+}
+
+/*
+  helper for talloc_reference()
+
+  this is referenced by a function pointer and should not be inline
+*/
+static int talloc_reference_destructor(struct talloc_reference_handle *handle)
+{
+	struct talloc_chunk *ptr_tc = talloc_chunk_from_ptr(handle->ptr);
+	_TLIST_REMOVE(ptr_tc->refs, handle);
+	return 0;
+}
+
+/*
+   more efficient way to add a name to a pointer - the name must point to a 
+   true string constant
+*/
+static inline void _talloc_set_name_const(const void *ptr, const char *name)
+{
+	struct talloc_chunk *tc = talloc_chunk_from_ptr(ptr);
+	tc->name = name;
+}
+
+/*
+  internal talloc_named_const()
+*/
+static inline void *_talloc_named_const(const void *context, size_t size, const char *name)
+{
+	void *ptr;
+
+	ptr = __talloc(context, size);
+	if (unlikely(ptr == NULL)) {
+		return NULL;
+	}
+
+	_talloc_set_name_const(ptr, name);
+
+	return ptr;
+}
+
+/*
+  make a secondary reference to a pointer, hanging off the given context.
+  the pointer remains valid until both the original caller and this given
+  context are freed.
+  
+  the major use for this is when two different structures need to reference the 
+  same underlying data, and you want to be able to free the two instances separately,
+  and in either order
+*/
+void *_talloc_reference(const void *context, const void *ptr)
+{
+	struct talloc_chunk *tc;
+	struct talloc_reference_handle *handle;
+	if (unlikely(ptr == NULL)) return NULL;
+
+	tc = talloc_chunk_from_ptr(ptr);
+	handle = (struct talloc_reference_handle *)_talloc_named_const(context,
+						   sizeof(struct talloc_reference_handle),
+						   TALLOC_MAGIC_REFERENCE);
+	if (unlikely(handle == NULL)) return NULL;
+
+	/* note that we hang the destructor off the handle, not the
+	   main context as that allows the caller to still setup their
+	   own destructor on the context if they want to */
+	talloc_set_destructor(handle, talloc_reference_destructor);
+	handle->ptr = discard_const_p(void, ptr);
+	_TLIST_ADD(tc->refs, handle);
+	return handle->ptr;
+}
+
+
+/* 
+   internal talloc_free call
+*/
+static inline int _talloc_free(void *ptr)
+{
+	struct talloc_chunk *tc;
+
+	if (unlikely(ptr == NULL)) {
+		return -1;
+	}
+
+	tc = talloc_chunk_from_ptr(ptr);
+
+	if (unlikely(tc->refs)) {
+		int is_child;
+		/* check this is a reference from a child or grantchild
+		 * back to it's parent or grantparent
+		 *
+		 * in that case we need to remove the reference and
+		 * call another instance of talloc_free() on the current
+		 * pointer.
+		 */
+		is_child = talloc_is_parent(tc->refs, ptr);
+		_talloc_free(tc->refs);
+		if (is_child) {
+			return _talloc_free(ptr);
+		}
+		return -1;
+	}
+
+	if (unlikely(tc->flags & TALLOC_FLAG_LOOP)) {
+		/* we have a free loop - stop looping */
+		return 0;
+	}
+
+	if (unlikely(tc->destructor)) {
+		talloc_destructor_t d = tc->destructor;
+		if (d == (talloc_destructor_t)-1) {
+			return -1;
+		}
+		tc->destructor = (talloc_destructor_t)-1;
+		if (d(ptr) == -1) {
+			tc->destructor = d;
+			return -1;
+		}
+		tc->destructor = NULL;
+	}
+
+	if (tc->parent) {
+		_TLIST_REMOVE(tc->parent->child, tc);
+		if (tc->parent->child) {
+			tc->parent->child->parent = tc->parent;
+		}
+	} else {
+		if (tc->prev) tc->prev->next = tc->next;
+		if (tc->next) tc->next->prev = tc->prev;
+	}
+
+	tc->flags |= TALLOC_FLAG_LOOP;
+
+	while (tc->child) {
+		/* we need to work out who will own an abandoned child
+		   if it cannot be freed. In priority order, the first
+		   choice is owner of any remaining reference to this
+		   pointer, the second choice is our parent, and the
+		   final choice is the null context. */
+		void *child = TC_PTR_FROM_CHUNK(tc->child);
+		const void *new_parent = null_context;
+		if (unlikely(tc->child->refs)) {
+			struct talloc_chunk *p = talloc_parent_chunk(tc->child->refs);
+			if (p) new_parent = TC_PTR_FROM_CHUNK(p);
+		}
+		if (unlikely(_talloc_free(child) == -1)) {
+			if (new_parent == null_context) {
+				struct talloc_chunk *p = talloc_parent_chunk(ptr);
+				if (p) new_parent = TC_PTR_FROM_CHUNK(p);
+			}
+			talloc_steal(new_parent, child);
+		}
+	}
+
+	tc->flags |= TALLOC_FLAG_FREE;
+
+	if (tc->flags & (TALLOC_FLAG_POOL|TALLOC_FLAG_POOLMEM)) {
+		struct talloc_chunk *pool;
+		unsigned int *pool_object_count;
+
+		pool = (tc->flags & TALLOC_FLAG_POOL)
+			? tc : (struct talloc_chunk *)tc->pool;
+
+		pool_object_count = talloc_pool_objectcount(pool);
+
+		if (*pool_object_count == 0) {
+			talloc_abort("Pool object count zero!");
+		}
+
+		*pool_object_count -= 1;
+
+		if (*pool_object_count == 0) {
+			free(pool);
+		}
+	}
+	else {
+		free(tc);
+	}
+	return 0;
+}
+
+/* 
+   move a lump of memory from one talloc context to another return the
+   ptr on success, or NULL if it could not be transferred.
+   passing NULL as ptr will always return NULL with no side effects.
+*/
+void *_talloc_steal(const void *new_ctx, const void *ptr)
+{
+	struct talloc_chunk *tc, *new_tc;
+
+	if (unlikely(!ptr)) {
+		return NULL;
+	}
+
+	if (unlikely(new_ctx == NULL)) {
+		new_ctx = null_context;
+	}
+
+	tc = talloc_chunk_from_ptr(ptr);
+
+	if (unlikely(new_ctx == NULL)) {
+		if (tc->parent) {
+			_TLIST_REMOVE(tc->parent->child, tc);
+			if (tc->parent->child) {
+				tc->parent->child->parent = tc->parent;
+			}
+		} else {
+			if (tc->prev) tc->prev->next = tc->next;
+			if (tc->next) tc->next->prev = tc->prev;
+		}
+		
+		tc->parent = tc->next = tc->prev = NULL;
+		return discard_const_p(void, ptr);
+	}
+
+	new_tc = talloc_chunk_from_ptr(new_ctx);
+
+	if (unlikely(tc == new_tc || tc->parent == new_tc)) {
+		return discard_const_p(void, ptr);
+	}
+
+	if (tc->parent) {
+		_TLIST_REMOVE(tc->parent->child, tc);
+		if (tc->parent->child) {
+			tc->parent->child->parent = tc->parent;
+		}
+	} else {
+		if (tc->prev) tc->prev->next = tc->next;
+		if (tc->next) tc->next->prev = tc->prev;
+	}
+
+	tc->parent = new_tc;
+	if (new_tc->child) new_tc->child->parent = NULL;
+	_TLIST_ADD(new_tc->child, tc);
+
+	return discard_const_p(void, ptr);
+}
+
+
+
+/*
+  remove a secondary reference to a pointer. This undo's what
+  talloc_reference() has done. The context and pointer arguments
+  must match those given to a talloc_reference()
+*/
+static inline int talloc_unreference(const void *context, const void *ptr)
+{
+	struct talloc_chunk *tc = talloc_chunk_from_ptr(ptr);
+	struct talloc_reference_handle *h;
+
+	if (unlikely(context == NULL)) {
+		context = null_context;
+	}
+
+	for (h=tc->refs;h;h=h->next) {
+		struct talloc_chunk *p = talloc_parent_chunk(h);
+		if (p == NULL) {
+			if (context == NULL) break;
+		} else if (TC_PTR_FROM_CHUNK(p) == context) {
+			break;
+		}
+	}
+	if (h == NULL) {
+		return -1;
+	}
+
+	return _talloc_free(h);
+}
+
+/*
+  remove a specific parent context from a pointer. This is a more
+  controlled varient of talloc_free()
+*/
+int talloc_unlink(const void *context, void *ptr)
+{
+	struct talloc_chunk *tc_p, *new_p;
+	void *new_parent;
+
+	if (ptr == NULL) {
+		return -1;
+	}
+
+	if (context == NULL) {
+		context = null_context;
+	}
+
+	if (talloc_unreference(context, ptr) == 0) {
+		return 0;
+	}
+
+	if (context == NULL) {
+		if (talloc_parent_chunk(ptr) != NULL) {
+			return -1;
+		}
+	} else {
+		if (talloc_chunk_from_ptr(context) != talloc_parent_chunk(ptr)) {
+			return -1;
+		}
+	}
+	
+	tc_p = talloc_chunk_from_ptr(ptr);
+
+	if (tc_p->refs == NULL) {
+		return _talloc_free(ptr);
+	}
+
+	new_p = talloc_parent_chunk(tc_p->refs);
+	if (new_p) {
+		new_parent = TC_PTR_FROM_CHUNK(new_p);
+	} else {
+		new_parent = NULL;
+	}
+
+	if (talloc_unreference(new_parent, ptr) != 0) {
+		return -1;
+	}
+
+	talloc_steal(new_parent, ptr);
+
+	return 0;
+}
+
+/*
+  add a name to an existing pointer - va_list version
+*/
+static inline const char *talloc_set_name_v(const void *ptr, const char *fmt, va_list ap) PRINTF_ATTRIBUTE(2,0);
+
+static inline const char *talloc_set_name_v(const void *ptr, const char *fmt, va_list ap)
+{
+	struct talloc_chunk *tc = talloc_chunk_from_ptr(ptr);
+	tc->name = talloc_vasprintf(ptr, fmt, ap);
+	if (likely(tc->name)) {
+		_talloc_set_name_const(tc->name, ".name");
+	}
+	return tc->name;
+}
+
+/*
+  add a name to an existing pointer
+*/
+const char *talloc_set_name(const void *ptr, const char *fmt, ...)
+{
+	const char *name;
+	va_list ap;
+	va_start(ap, fmt);
+	name = talloc_set_name_v(ptr, fmt, ap);
+	va_end(ap);
+	return name;
+}
+
+
+/*
+  create a named talloc pointer. Any talloc pointer can be named, and
+  talloc_named() operates just like talloc() except that it allows you
+  to name the pointer.
+*/
+void *talloc_named(const void *context, size_t size, const char *fmt, ...)
+{
+	va_list ap;
+	void *ptr;
+	const char *name;
+
+	ptr = __talloc(context, size);
+	if (unlikely(ptr == NULL)) return NULL;
+
+	va_start(ap, fmt);
+	name = talloc_set_name_v(ptr, fmt, ap);
+	va_end(ap);
+
+	if (unlikely(name == NULL)) {
+		_talloc_free(ptr);
+		return NULL;
+	}
+
+	return ptr;
+}
+
+/*
+  return the name of a talloc ptr, or "UNNAMED"
+*/
+const char *talloc_get_name(const void *ptr)
+{
+	struct talloc_chunk *tc = talloc_chunk_from_ptr(ptr);
+	if (unlikely(tc->name == TALLOC_MAGIC_REFERENCE)) {
+		return ".reference";
+	}
+	if (likely(tc->name)) {
+		return tc->name;
+	}
+	return "UNNAMED";
+}
+
+
+/*
+  check if a pointer has the given name. If it does, return the pointer,
+  otherwise return NULL
+*/
+void *talloc_check_name(const void *ptr, const char *name)
+{
+	const char *pname;
+	if (unlikely(ptr == NULL)) return NULL;
+	pname = talloc_get_name(ptr);
+	if (likely(pname == name || strcmp(pname, name) == 0)) {
+		return discard_const_p(void, ptr);
+	}
+	return NULL;
+}
+
+static void talloc_abort_type_missmatch(const char *location,
+					const char *name,
+					const char *expected)
+{
+	const char *reason;
+
+	reason = talloc_asprintf(NULL,
+				 "%s: Type mismatch: name[%s] expected[%s]",
+				 location,
+				 name?name:"NULL",
+				 expected);
+	if (!reason) {
+		reason = "Type mismatch";
+	}
+
+	talloc_abort(reason);
+}
+
+void *_talloc_get_type_abort(const void *ptr, const char *name, const char *location)
+{
+	const char *pname;
+
+	if (unlikely(ptr == NULL)) {
+		talloc_abort_type_missmatch(location, NULL, name);
+		return NULL;
+	}
+
+	pname = talloc_get_name(ptr);
+	if (likely(pname == name || strcmp(pname, name) == 0)) {
+		return discard_const_p(void, ptr);
+	}
+
+	talloc_abort_type_missmatch(location, pname, name);
+	return NULL;
+}
+
+/*
+  this is for compatibility with older versions of talloc
+*/
+void *talloc_init(const char *fmt, ...)
+{
+	va_list ap;
+	void *ptr;
+	const char *name;
+
+	/*
+	 * samba3 expects talloc_report_depth_cb(NULL, ...)
+	 * reports all talloc'ed memory, so we need to enable
+	 * null_tracking
+	 */
+	talloc_enable_null_tracking();
+
+	ptr = __talloc(NULL, 0);
+	if (unlikely(ptr == NULL)) return NULL;
+
+	va_start(ap, fmt);
+	name = talloc_set_name_v(ptr, fmt, ap);
+	va_end(ap);
+
+	if (unlikely(name == NULL)) {
+		_talloc_free(ptr);
+		return NULL;
+	}
+
+	return ptr;
+}
+
+/*
+  this is a replacement for the Samba3 talloc_destroy_pool functionality. It
+  should probably not be used in new code. It's in here to keep the talloc
+  code consistent across Samba 3 and 4.
+*/
+void talloc_free_children(void *ptr)
+{
+	struct talloc_chunk *tc;
+
+	if (unlikely(ptr == NULL)) {
+		return;
+	}
+
+	tc = talloc_chunk_from_ptr(ptr);
+
+	while (tc->child) {
+		/* we need to work out who will own an abandoned child
+		   if it cannot be freed. In priority order, the first
+		   choice is owner of any remaining reference to this
+		   pointer, the second choice is our parent, and the
+		   final choice is the null context. */
+		void *child = TC_PTR_FROM_CHUNK(tc->child);
+		const void *new_parent = null_context;
+		if (unlikely(tc->child->refs)) {
+			struct talloc_chunk *p = talloc_parent_chunk(tc->child->refs);
+			if (p) new_parent = TC_PTR_FROM_CHUNK(p);
+		}
+		if (unlikely(_talloc_free(child) == -1)) {
+			if (new_parent == null_context) {
+				struct talloc_chunk *p = talloc_parent_chunk(ptr);
+				if (p) new_parent = TC_PTR_FROM_CHUNK(p);
+			}
+			talloc_steal(new_parent, child);
+		}
+	}
+
+	if ((tc->flags & TALLOC_FLAG_POOL)
+	    && (*talloc_pool_objectcount(tc) == 1)) {
+		tc->pool = ((char *)tc + TC_HDR_SIZE + TALLOC_POOL_HDR_SIZE);
+#if defined(DEVELOPER) && defined(VALGRIND_MAKE_MEM_NOACCESS)
+		VALGRIND_MAKE_MEM_NOACCESS(
+			tc->pool, tc->size - TALLOC_POOL_HDR_SIZE);
+#endif
+	}
+}
+
+/* 
+   Allocate a bit of memory as a child of an existing pointer
+*/
+void *_talloc(const void *context, size_t size)
+{
+	return __talloc(context, size);
+}
+
+/*
+  externally callable talloc_set_name_const()
+*/
+void talloc_set_name_const(const void *ptr, const char *name)
+{
+	_talloc_set_name_const(ptr, name);
+}
+
+/*
+  create a named talloc pointer. Any talloc pointer can be named, and
+  talloc_named() operates just like talloc() except that it allows you
+  to name the pointer.
+*/
+void *talloc_named_const(const void *context, size_t size, const char *name)
+{
+	return _talloc_named_const(context, size, name);
+}
+
+/* 
+   free a talloc pointer. This also frees all child pointers of this 
+   pointer recursively
+
+   return 0 if the memory is actually freed, otherwise -1. The memory
+   will not be freed if the ref_count is > 1 or the destructor (if
+   any) returns non-zero
+*/
+int talloc_free(void *ptr)
+{
+	return _talloc_free(ptr);
+}
+
+
+
+/*
+  A talloc version of realloc. The context argument is only used if
+  ptr is NULL
+*/
+void *_talloc_realloc(const void *context, void *ptr, size_t size, const char *name)
+{
+	struct talloc_chunk *tc;
+	void *new_ptr;
+	bool malloced = false;
+
+	/* size zero is equivalent to free() */
+	if (unlikely(size == 0)) {
+		_talloc_free(ptr);
+		return NULL;
+	}
+
+	if (unlikely(size >= MAX_TALLOC_SIZE)) {
+		return NULL;
+	}
+
+	/* realloc(NULL) is equivalent to malloc() */
+	if (ptr == NULL) {
+		return _talloc_named_const(context, size, name);
+	}
+
+	tc = talloc_chunk_from_ptr(ptr);
+
+	/* don't allow realloc on referenced pointers */
+	if (unlikely(tc->refs)) {
+		return NULL;
+	}
+
+	/* don't let anybody try to realloc a talloc_pool */
+	if (unlikely(tc->flags & TALLOC_FLAG_POOL)) {
+		return NULL;
+	}
+
+	/* don't shrink if we have less than 1k to gain */
+	if ((size < tc->size) && ((tc->size - size) < 1024)) {
+		tc->size = size;
+		return ptr;
+	}
+
+	/* by resetting magic we catch users of the old memory */
+	tc->flags |= TALLOC_FLAG_FREE;
+
+#if ALWAYS_REALLOC
+	new_ptr = malloc(size + TC_HDR_SIZE);
+	if (new_ptr) {
+		memcpy(new_ptr, tc, tc->size + TC_HDR_SIZE);
+		free(tc);
+	}
+#else
+	if (tc->flags & TALLOC_FLAG_POOLMEM) {
+
+		new_ptr = talloc_alloc_pool(tc, size + TC_HDR_SIZE);
+		*talloc_pool_objectcount((struct talloc_chunk *)
+					 (tc->pool)) -= 1;
+
+		if (new_ptr == NULL) {
+			new_ptr = malloc(TC_HDR_SIZE+size);
+			malloced = true;
+		}
+
+		if (new_ptr) {
+			memcpy(new_ptr, tc, MIN(tc->size,size) + TC_HDR_SIZE);
+		}
+	}
+	else {
+		new_ptr = realloc(tc, size + TC_HDR_SIZE);
+	}
+#endif
+	if (unlikely(!new_ptr)) {	
+		tc->flags &= ~TALLOC_FLAG_FREE; 
+		return NULL; 
+	}
+
+	tc = (struct talloc_chunk *)new_ptr;
+	tc->flags &= ~TALLOC_FLAG_FREE;
+	if (malloced) {
+		tc->flags &= ~TALLOC_FLAG_POOLMEM;
+	}
+	if (tc->parent) {
+		tc->parent->child = tc;
+	}
+	if (tc->child) {
+		tc->child->parent = tc;
+	}
+
+	if (tc->prev) {
+		tc->prev->next = tc;
+	}
+	if (tc->next) {
+		tc->next->prev = tc;
+	}
+
+	tc->size = size;
+	_talloc_set_name_const(TC_PTR_FROM_CHUNK(tc), name);
+
+	return TC_PTR_FROM_CHUNK(tc);
+}
+
+/*
+  a wrapper around talloc_steal() for situations where you are moving a pointer
+  between two structures, and want the old pointer to be set to NULL
+*/
+void *_talloc_move(const void *new_ctx, const void *_pptr)
+{
+	const void **pptr = discard_const_p(const void *,_pptr);
+	void *ret = _talloc_steal(new_ctx, *pptr);
+	(*pptr) = NULL;
+	return ret;
+}
+
+/*
+  return the total size of a talloc pool (subtree)
+*/
+size_t talloc_total_size(const void *ptr)
+{
+	size_t total = 0;
+	struct talloc_chunk *c, *tc;
+
+	if (ptr == NULL) {
+		ptr = null_context;
+	}
+	if (ptr == NULL) {
+		return 0;
+	}
+
+	tc = talloc_chunk_from_ptr(ptr);
+
+	if (tc->flags & TALLOC_FLAG_LOOP) {
+		return 0;
+	}
+
+	tc->flags |= TALLOC_FLAG_LOOP;
+
+	total = tc->size;
+	for (c=tc->child;c;c=c->next) {
+		total += talloc_total_size(TC_PTR_FROM_CHUNK(c));
+	}
+
+	tc->flags &= ~TALLOC_FLAG_LOOP;
+
+	return total;
+}
+
+/*
+  return the total number of blocks in a talloc pool (subtree)
+*/
+size_t talloc_total_blocks(const void *ptr)
+{
+	size_t total = 0;
+	struct talloc_chunk *c, *tc = talloc_chunk_from_ptr(ptr);
+
+	if (tc->flags & TALLOC_FLAG_LOOP) {
+		return 0;
+	}
+
+	tc->flags |= TALLOC_FLAG_LOOP;
+
+	total++;
+	for (c=tc->child;c;c=c->next) {
+		total += talloc_total_blocks(TC_PTR_FROM_CHUNK(c));
+	}
+
+	tc->flags &= ~TALLOC_FLAG_LOOP;
+
+	return total;
+}
+
+/*
+  return the number of external references to a pointer
+*/
+size_t talloc_reference_count(const void *ptr)
+{
+	struct talloc_chunk *tc = talloc_chunk_from_ptr(ptr);
+	struct talloc_reference_handle *h;
+	size_t ret = 0;
+
+	for (h=tc->refs;h;h=h->next) {
+		ret++;
+	}
+	return ret;
+}
+
+/*
+  report on memory usage by all children of a pointer, giving a full tree view
+*/
+void talloc_report_depth_cb(const void *ptr, int depth, int max_depth,
+			    void (*callback)(const void *ptr,
+			  		     int depth, int max_depth,
+					     int is_ref,
+					     void *private_data),
+			    void *private_data)
+{
+	struct talloc_chunk *c, *tc;
+
+	if (ptr == NULL) {
+		ptr = null_context;
+	}
+	if (ptr == NULL) return;
+
+	tc = talloc_chunk_from_ptr(ptr);
+
+	if (tc->flags & TALLOC_FLAG_LOOP) {
+		return;
+	}
+
+	callback(ptr, depth, max_depth, 0, private_data);
+
+	if (max_depth >= 0 && depth >= max_depth) {
+		return;
+	}
+
+	tc->flags |= TALLOC_FLAG_LOOP;
+	for (c=tc->child;c;c=c->next) {
+		if (c->name == TALLOC_MAGIC_REFERENCE) {
+			struct talloc_reference_handle *h = (struct talloc_reference_handle *)TC_PTR_FROM_CHUNK(c);
+			callback(h->ptr, depth + 1, max_depth, 1, private_data);
+		} else {
+			talloc_report_depth_cb(TC_PTR_FROM_CHUNK(c), depth + 1, max_depth, callback, private_data);
+		}
+	}
+	tc->flags &= ~TALLOC_FLAG_LOOP;
+}
+
+static void talloc_report_depth_FILE_helper(const void *ptr, int depth, int max_depth, int is_ref, void *_f)
+{
+	const char *name = talloc_get_name(ptr);
+	FILE *f = (FILE *)_f;
+
+	if (is_ref) {
+		fprintf(f, "%*sreference to: %s\n", depth*4, "", name);
+		return;
+	}
+
+	if (depth == 0) {
+		fprintf(f,"%stalloc report on '%s' (total %6lu bytes in %3lu blocks)\n", 
+			(max_depth < 0 ? "full " :""), name,
+			(unsigned long)talloc_total_size(ptr),
+			(unsigned long)talloc_total_blocks(ptr));
+		return;
+	}
+
+	fprintf(f, "%*s%-30s contains %6lu bytes in %3lu blocks (ref %d) %p\n", 
+		depth*4, "",
+		name,
+		(unsigned long)talloc_total_size(ptr),
+		(unsigned long)talloc_total_blocks(ptr),
+		(int)talloc_reference_count(ptr), ptr);
+
+#if 0
+	fprintf(f, "content: ");
+	if (talloc_total_size(ptr)) {
+		int tot = talloc_total_size(ptr);
+		int i;
+
+		for (i = 0; i < tot; i++) {
+			if ((((char *)ptr)[i] > 31) && (((char *)ptr)[i] < 126)) {
+				fprintf(f, "%c", ((char *)ptr)[i]);
+			} else {
+				fprintf(f, "~%02x", ((char *)ptr)[i]);
+			}
+		}
+	}
+	fprintf(f, "\n");
+#endif
+}
+
+/*
+  report on memory usage by all children of a pointer, giving a full tree view
+*/
+void talloc_report_depth_file(const void *ptr, int depth, int max_depth, FILE *f)
+{
+	talloc_report_depth_cb(ptr, depth, max_depth, talloc_report_depth_FILE_helper, f);
+	fflush(f);
+}
+
+/*
+  report on memory usage by all children of a pointer, giving a full tree view
+*/
+void talloc_report_full(const void *ptr, FILE *f)
+{
+	talloc_report_depth_file(ptr, 0, -1, f);
+}
+
+/*
+  report on memory usage by all children of a pointer
+*/
+void talloc_report(const void *ptr, FILE *f)
+{
+	talloc_report_depth_file(ptr, 0, 1, f);
+}
+
+/*
+  report on any memory hanging off the null context
+*/
+static void talloc_report_null(void)
+{
+	if (talloc_total_size(null_context) != 0) {
+		talloc_report(null_context, stderr);
+	}
+}
+
+/*
+  report on any memory hanging off the null context
+*/
+static void talloc_report_null_full(void)
+{
+	if (talloc_total_size(null_context) != 0) {
+		talloc_report_full(null_context, stderr);
+	}
+}
+
+/*
+  enable tracking of the NULL context
+*/
+void talloc_enable_null_tracking(void)
+{
+	if (null_context == NULL) {
+		null_context = _talloc_named_const(NULL, 0, "null_context");
+	}
+}
+
+/*
+  disable tracking of the NULL context
+*/
+void talloc_disable_null_tracking(void)
+{
+	_talloc_free(null_context);
+	null_context = NULL;
+}
+
+/*
+  enable leak reporting on exit
+*/
+void talloc_enable_leak_report(void)
+{
+	talloc_enable_null_tracking();
+	atexit(talloc_report_null);
+}
+
+/*
+  enable full leak reporting on exit
+*/
+void talloc_enable_leak_report_full(void)
+{
+	talloc_enable_null_tracking();
+	atexit(talloc_report_null_full);
+}
+
+/* 
+   talloc and zero memory. 
+*/
+void *_talloc_zero(const void *ctx, size_t size, const char *name)
+{
+	void *p = _talloc_named_const(ctx, size, name);
+
+	if (p) {
+		memset(p, '\0', size);
+	}
+
+	return p;
+}
+
+/*
+  memdup with a talloc. 
+*/
+void *_talloc_memdup(const void *t, const void *p, size_t size, const char *name)
+{
+	void *newp = _talloc_named_const(t, size, name);
+
+	if (likely(newp)) {
+		memcpy(newp, p, size);
+	}
+
+	return newp;
+}
+
+static inline char *__talloc_strlendup(const void *t, const char *p, size_t len)
+{
+	char *ret;
+
+	ret = (char *)__talloc(t, len + 1);
+	if (unlikely(!ret)) return NULL;
+
+	memcpy(ret, p, len);
+	ret[len] = 0;
+
+	_talloc_set_name_const(ret, ret);
+	return ret;
+}
+
+/*
+  strdup with a talloc
+*/
+char *talloc_strdup(const void *t, const char *p)
+{
+	if (unlikely(!p)) return NULL;
+	return __talloc_strlendup(t, p, strlen(p));
+}
+
+/*
+  strndup with a talloc
+*/
+char *talloc_strndup(const void *t, const char *p, size_t n)
+{
+	if (unlikely(!p)) return NULL;
+	return __talloc_strlendup(t, p, strnlen(p, n));
+}
+
+static inline char *__talloc_strlendup_append(char *s, size_t slen,
+					      const char *a, size_t alen)
+{
+	char *ret;
+
+	ret = talloc_realloc(NULL, s, char, slen + alen + 1);
+	if (unlikely(!ret)) return NULL;
+
+	/* append the string and the trailing \0 */
+	memcpy(&ret[slen], a, alen);
+	ret[slen+alen] = 0;
+
+	_talloc_set_name_const(ret, ret);
+	return ret;
+}
+
+/*
+ * Appends at the end of the string.
+ */
+char *talloc_strdup_append(char *s, const char *a)
+{
+	if (unlikely(!s)) {
+		return talloc_strdup(NULL, a);
+	}
+
+	if (unlikely(!a)) {
+		return s;
+	}
+
+	return __talloc_strlendup_append(s, strlen(s), a, strlen(a));
+}
+
+/*
+ * Appends at the end of the talloc'ed buffer,
+ * not the end of the string.
+ */
+char *talloc_strdup_append_buffer(char *s, const char *a)
+{
+	size_t slen;
+
+	if (unlikely(!s)) {
+		return talloc_strdup(NULL, a);
+	}
+
+	if (unlikely(!a)) {
+		return s;
+	}
+
+	slen = talloc_get_size(s);
+	if (likely(slen > 0)) {
+		slen--;
+	}
+
+	return __talloc_strlendup_append(s, slen, a, strlen(a));
+}
+
+/*
+ * Appends at the end of the string.
+ */
+char *talloc_strndup_append(char *s, const char *a, size_t n)
+{
+	if (unlikely(!s)) {
+		return talloc_strdup(NULL, a);
+	}
+
+	if (unlikely(!a)) {
+		return s;
+	}
+
+	return __talloc_strlendup_append(s, strlen(s), a, strnlen(a, n));
+}
+
+/*
+ * Appends at the end of the talloc'ed buffer,
+ * not the end of the string.
+ */
+char *talloc_strndup_append_buffer(char *s, const char *a, size_t n)
+{
+	size_t slen;
+
+	if (unlikely(!s)) {
+		return talloc_strdup(NULL, a);
+	}
+
+	if (unlikely(!a)) {
+		return s;
+	}
+
+	slen = talloc_get_size(s);
+	if (likely(slen > 0)) {
+		slen--;
+	}
+
+	return __talloc_strlendup_append(s, slen, a, strnlen(a, n));
+}
+
+#ifndef HAVE_VA_COPY
+#ifdef HAVE___VA_COPY
+#define va_copy(dest, src) __va_copy(dest, src)
+#else
+#define va_copy(dest, src) (dest) = (src)
+#endif
+#endif
+
+char *talloc_vasprintf(const void *t, const char *fmt, va_list ap)
+{
+	int len;
+	char *ret;
+	va_list ap2;
+	char c;
+
+	/* this call looks strange, but it makes it work on older solaris boxes */
+	va_copy(ap2, ap);
+	len = vsnprintf(&c, 1, fmt, ap2);
+	va_end(ap2);
+	if (unlikely(len < 0)) {
+		return NULL;
+	}
+
+	ret = (char *)__talloc(t, len+1);
+	if (unlikely(!ret)) return NULL;
+
+	va_copy(ap2, ap);
+	vsnprintf(ret, len+1, fmt, ap2);
+	va_end(ap2);
+
+	_talloc_set_name_const(ret, ret);
+	return ret;
+}
+
+
+/*
+  Perform string formatting, and return a pointer to newly allocated
+  memory holding the result, inside a memory pool.
+ */
+char *talloc_asprintf(const void *t, const char *fmt, ...)
+{
+	va_list ap;
+	char *ret;
+
+	va_start(ap, fmt);
+	ret = talloc_vasprintf(t, fmt, ap);
+	va_end(ap);
+	return ret;
+}
+
+static inline char *__talloc_vaslenprintf_append(char *s, size_t slen,
+						 const char *fmt, va_list ap)
+						 PRINTF_ATTRIBUTE(3,0);
+
+static inline char *__talloc_vaslenprintf_append(char *s, size_t slen,
+						 const char *fmt, va_list ap)
+{
+	ssize_t alen;
+	va_list ap2;
+	char c;
+
+	va_copy(ap2, ap);
+	alen = vsnprintf(&c, 1, fmt, ap2);
+	va_end(ap2);
+
+	if (alen <= 0) {
+		/* Either the vsnprintf failed or the format resulted in
+		 * no characters being formatted. In the former case, we
+		 * ought to return NULL, in the latter we ought to return
+		 * the original string. Most current callers of this
+		 * function expect it to never return NULL.
+		 */
+		return s;
+	}
+
+	s = talloc_realloc(NULL, s, char, slen + alen + 1);
+	if (!s) return NULL;
+
+	va_copy(ap2, ap);
+	vsnprintf(s + slen, alen + 1, fmt, ap2);
+	va_end(ap2);
+
+	_talloc_set_name_const(s, s);
+	return s;
+}
+
+/**
+ * Realloc @p s to append the formatted result of @p fmt and @p ap,
+ * and return @p s, which may have moved.  Good for gradually
+ * accumulating output into a string buffer. Appends at the end
+ * of the string.
+ **/
+char *talloc_vasprintf_append(char *s, const char *fmt, va_list ap)
+{
+	if (unlikely(!s)) {
+		return talloc_vasprintf(NULL, fmt, ap);
+	}
+
+	return __talloc_vaslenprintf_append(s, strlen(s), fmt, ap);
+}
+
+/**
+ * Realloc @p s to append the formatted result of @p fmt and @p ap,
+ * and return @p s, which may have moved. Always appends at the
+ * end of the talloc'ed buffer, not the end of the string.
+ **/
+char *talloc_vasprintf_append_buffer(char *s, const char *fmt, va_list ap)
+{
+	size_t slen;
+
+	if (unlikely(!s)) {
+		return talloc_vasprintf(NULL, fmt, ap);
+	}
+
+	slen = talloc_get_size(s);
+	if (likely(slen > 0)) {
+		slen--;
+	}
+
+	return __talloc_vaslenprintf_append(s, slen, fmt, ap);
+}
+
+/*
+  Realloc @p s to append the formatted result of @p fmt and return @p
+  s, which may have moved.  Good for gradually accumulating output
+  into a string buffer.
+ */
+char *talloc_asprintf_append(char *s, const char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	s = talloc_vasprintf_append(s, fmt, ap);
+	va_end(ap);
+	return s;
+}
+
+/*
+  Realloc @p s to append the formatted result of @p fmt and return @p
+  s, which may have moved.  Good for gradually accumulating output
+  into a buffer.
+ */
+char *talloc_asprintf_append_buffer(char *s, const char *fmt, ...)
+{
+	va_list ap;
+
+	va_start(ap, fmt);
+	s = talloc_vasprintf_append_buffer(s, fmt, ap);
+	va_end(ap);
+	return s;
+}
+
+/*
+  alloc an array, checking for integer overflow in the array size
+*/
+void *_talloc_array(const void *ctx, size_t el_size, unsigned count, const char *name)
+{
+	if (count >= MAX_TALLOC_SIZE/el_size) {
+		return NULL;
+	}
+	return _talloc_named_const(ctx, el_size * count, name);
+}
+
+/*
+  alloc an zero array, checking for integer overflow in the array size
+*/
+void *_talloc_zero_array(const void *ctx, size_t el_size, unsigned count, const char *name)
+{
+	if (count >= MAX_TALLOC_SIZE/el_size) {
+		return NULL;
+	}
+	return _talloc_zero(ctx, el_size * count, name);
+}
+
+/*
+  realloc an array, checking for integer overflow in the array size
+*/
+void *_talloc_realloc_array(const void *ctx, void *ptr, size_t el_size, unsigned count, const char *name)
+{
+	if (count >= MAX_TALLOC_SIZE/el_size) {
+		return NULL;
+	}
+	return _talloc_realloc(ctx, ptr, el_size * count, name);
+}
+
+/*
+  a function version of talloc_realloc(), so it can be passed as a function pointer
+  to libraries that want a realloc function (a realloc function encapsulates
+  all the basic capabilities of an allocation library, which is why this is useful)
+*/
+void *talloc_realloc_fn(const void *context, void *ptr, size_t size)
+{
+	return _talloc_realloc(context, ptr, size, NULL);
+}
+
+
+static int talloc_autofree_destructor(void *ptr)
+{
+	autofree_context = NULL;
+	return 0;
+}
+
+static void talloc_autofree(void)
+{
+	_talloc_free(autofree_context);
+}
+
+/*
+  return a context which will be auto-freed on exit
+  this is useful for reducing the noise in leak reports
+*/
+void *talloc_autofree_context(void)
+{
+	if (autofree_context == NULL) {
+		autofree_context = _talloc_named_const(NULL, 0, "autofree_context");
+		talloc_set_destructor(autofree_context, talloc_autofree_destructor);
+		atexit(talloc_autofree);
+	}
+	return autofree_context;
+}
+
+size_t talloc_get_size(const void *context)
+{
+	struct talloc_chunk *tc;
+
+	if (context == NULL)
+		return 0;
+
+	tc = talloc_chunk_from_ptr(context);
+
+	return tc->size;
+}
+
+/*
+  find a parent of this context that has the given name, if any
+*/
+void *talloc_find_parent_byname(const void *context, const char *name)
+{
+	struct talloc_chunk *tc;
+
+	if (context == NULL) {
+		return NULL;
+	}
+
+	tc = talloc_chunk_from_ptr(context);
+	while (tc) {
+		if (tc->name && strcmp(tc->name, name) == 0) {
+			return TC_PTR_FROM_CHUNK(tc);
+		}
+		while (tc && tc->prev) tc = tc->prev;
+		if (tc) {
+			tc = tc->parent;
+		}
+	}
+	return NULL;
+}
+
+/*
+  show the parentage of a context
+*/
+void talloc_show_parents(const void *context, FILE *file)
+{
+	struct talloc_chunk *tc;
+
+	if (context == NULL) {
+		fprintf(file, "talloc no parents for NULL\n");
+		return;
+	}
+
+	tc = talloc_chunk_from_ptr(context);
+	fprintf(file, "talloc parents of '%s'\n", talloc_get_name(context));
+	while (tc) {
+		fprintf(file, "\t'%s'\n", talloc_get_name(TC_PTR_FROM_CHUNK(tc)));
+		while (tc && tc->prev) tc = tc->prev;
+		if (tc) {
+			tc = tc->parent;
+		}
+	}
+	fflush(file);
+}
+
+/*
+  return 1 if ptr is a parent of context
+*/
+int talloc_is_parent(const void *context, const void *ptr)
+{
+	struct talloc_chunk *tc;
+
+	if (context == NULL) {
+		return 0;
+	}
+
+	tc = talloc_chunk_from_ptr(context);
+	while (tc) {
+		if (TC_PTR_FROM_CHUNK(tc) == ptr) return 1;
+		while (tc && tc->prev) tc = tc->prev;
+		if (tc) {
+			tc = tc->parent;
+		}
+	}
+	return 0;
+}
diff --git a/openbsc/src/telnet_interface.c b/openbsc/src/telnet_interface.c
index f4ffb52..7a67fe1 100644
--- a/openbsc/src/telnet_interface.c
+++ b/openbsc/src/telnet_interface.c
@@ -34,6 +34,7 @@
 #include <openbsc/abis_rsl.h>
 #include <openbsc/paging.h>
 #include <openbsc/signal.h>
+#include <openbsc/talloc.h>
 
 #include <vty/buffer.h>
 
@@ -47,6 +48,8 @@
 /* per connection data */
 LLIST_HEAD(active_connections);
 
+static void *tall_telnet_ctx;
+
 /* per network data */
 static int telnet_new_connection(struct bsc_fd *fd, unsigned int what);
 #if 0
@@ -66,6 +69,9 @@
 	struct sockaddr_in sock_addr;
 	int fd, on = 1;
 
+	tall_telnet_ctx = talloc_named_const(tall_bsc_ctx, 1,
+					     "telnet_connection");
+
 	bsc_vty_init(network);
 
 	fd = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
@@ -126,7 +132,7 @@
 	close(fd->fd);
 	bsc_unregister_fd(fd);
 	llist_del(&conn->entry);
-	free(conn);
+	talloc_free(conn);
 	return 0;
 }
 
@@ -161,8 +167,7 @@
 	}
 
 
-	connection = (struct telnet_connection*)malloc(sizeof(*connection));
-	memset(connection, 0, sizeof(*connection));
+	connection = talloc_zero(tall_telnet_ctx, struct telnet_connection);
 	connection->network = (struct gsm_network*)fd->data;
 	connection->fd.data = connection;
 	connection->fd.fd = new_connection;
diff --git a/openbsc/src/trau_mux.c b/openbsc/src/trau_mux.c
index 196d15f..04febbd 100644
--- a/openbsc/src/trau_mux.c
+++ b/openbsc/src/trau_mux.c
@@ -30,6 +30,7 @@
 #include <openbsc/subchan_demux.h>
 #include <openbsc/e1_input.h>
 #include <openbsc/debug.h>
+#include <openbsc/talloc.h>
 
 struct map_entry {
 	struct llist_head list;
@@ -46,11 +47,19 @@
 static LLIST_HEAD(ss_map);
 static LLIST_HEAD(ss_upqueue);
 
+static void *tall_map_ctx, *tall_upq_ctx;
+
 /* map one particular subslot to another subslot */
 int trau_mux_map(const struct gsm_e1_subslot *src,
 		 const struct gsm_e1_subslot *dst)
 {
-	struct map_entry *me = malloc(sizeof(*me));
+	struct map_entry *me;
+
+	if (!tall_map_ctx)
+		tall_map_ctx = talloc_named_const(tall_bsc_ctx, 1,
+						  "trau_map_entry");
+
+	me = talloc(tall_map_ctx, struct map_entry);
 	if (!me)
 		return -ENOMEM;
 
@@ -161,7 +170,8 @@
 			return -EINVAL;
 		if (!ue->callref)
 			return -EINVAL;
-		msg = msgb_alloc(sizeof(struct gsm_trau_frame) + sizeof(tf));
+		msg = msgb_alloc(sizeof(struct gsm_trau_frame) + sizeof(tf),
+				 "TRAU");
 		if (!msg)
 			return -ENOMEM;
 		frame = (struct gsm_trau_frame *)msg->data;
@@ -189,8 +199,13 @@
 int trau_recv_lchan(struct gsm_lchan *lchan, u_int32_t callref)
 {
 	struct gsm_e1_subslot *src_ss;
-	struct upqueue_entry *ue = malloc(sizeof(*ue));
+	struct upqueue_entry *ue;
 
+	if (!tall_upq_ctx)
+		tall_upq_ctx = talloc_named_const(tall_bsc_ctx, 1,
+						  "trau_upq_entry");
+
+	ue = talloc(tall_upq_ctx, struct upqueue_entry);
 	if (!ue)
 		return -ENOMEM;
 
diff --git a/openbsc/src/vty/vty.c b/openbsc/src/vty/vty.c
index ca6fff7..c461631 100644
--- a/openbsc/src/vty/vty.c
+++ b/openbsc/src/vty/vty.c
@@ -161,6 +161,9 @@
 
 	/* OK free vty. */
 	free(vty);
+
+	/* FIXME: memory leak. We need to call telnet_close_client() but don't
+	 * have bfd */
 }
 
 int vty_shell(struct vty *vty)
diff --git a/openbsc/src/vty_interface.c b/openbsc/src/vty_interface.c
index a2b3e56..12d5ae9 100644
--- a/openbsc/src/vty_interface.c
+++ b/openbsc/src/vty_interface.c
@@ -147,12 +147,12 @@
 				VTY_NEWLINE);
 			return CMD_WARNING;
 		}
-		bts_dump_vty(vty, &net->bts[bts_nr]);
+		bts_dump_vty(vty, gsm_bts_num(net, bts_nr));
 		return CMD_SUCCESS;
 	}
 	/* print all BTS's */
 	for (bts_nr = 0; bts_nr < net->num_bts; bts_nr++)
-		bts_dump_vty(vty, &net->bts[bts_nr]);
+		bts_dump_vty(vty, gsm_bts_num(net, bts_nr));
 
 	return CMD_SUCCESS;
 }
@@ -191,7 +191,7 @@
 				VTY_NEWLINE);
 			return CMD_WARNING;
 		}
-		bts = &net->bts[bts_nr];
+		bts = gsm_bts_num(net, bts_nr);
 	}
 	if (argc >= 2) {
 		trx_nr = atoi(argv[1]);
@@ -200,23 +200,23 @@
 				VTY_NEWLINE);
 			return CMD_WARNING;
 		}
-		trx = &bts->trx[trx_nr];
+		trx = gsm_bts_trx_num(bts, trx_nr);
 		trx_dump_vty(vty, trx);
 		return CMD_SUCCESS;
 	}
 	if (bts) {
 		/* print all TRX in this BTS */
 		for (trx_nr = 0; trx_nr < bts->num_trx; trx_nr++) {
-			trx = &bts->trx[trx_nr];
+			trx = gsm_bts_trx_num(bts, trx_nr);
 			trx_dump_vty(vty, trx);
 		}
 		return CMD_SUCCESS;
 	}
 
 	for (bts_nr = 0; bts_nr < net->num_bts; bts_nr++) {
-		bts = &net->bts[bts_nr];
+		bts = gsm_bts_num(net, bts_nr);
 		for (trx_nr = 0; trx_nr < bts->num_trx; trx_nr++) {
-			trx = &bts->trx[trx_nr];
+			trx = gsm_bts_trx_num(bts, trx_nr);
 			trx_dump_vty(vty, trx);
 		}
 	}
@@ -265,7 +265,7 @@
 				VTY_NEWLINE);
 			return CMD_WARNING;
 		}
-		bts = &net->bts[bts_nr];
+		bts = gsm_bts_num(net, bts_nr);
 	}
 	if (argc >= 2) {
 		trx_nr = atoi(argv[1]);
@@ -274,7 +274,7 @@
 				VTY_NEWLINE);
 			return CMD_WARNING;
 		}
-		trx = &bts->trx[trx_nr];
+		trx = gsm_bts_trx_num(bts, trx_nr);
 	}
 	if (argc >= 3) {
 		ts_nr = atoi(argv[2]);
@@ -288,9 +288,9 @@
 		return CMD_SUCCESS;
 	}
 	for (bts_nr = 0; bts_nr < net->num_bts; bts_nr++) {
-		bts = &net->bts[bts_nr];
+		bts = gsm_bts_num(net, bts_nr);
 		for (trx_nr = 0; trx_nr < bts->num_trx; trx_nr++) {
-			trx = &bts->trx[trx_nr];
+			trx = gsm_bts_trx_num(bts, trx_nr);
 			for (ts_nr = 0; ts_nr < TRX_NR_TS; ts_nr++) {
 				ts = &trx->ts[ts_nr];
 				ts_dump_vty(vty, ts);
@@ -379,7 +379,7 @@
 				VTY_NEWLINE);
 			return CMD_WARNING;
 		}
-		bts = &net->bts[bts_nr];
+		bts = gsm_bts_num(net, bts_nr);
 	}
 	if (argc >= 2) {
 		trx_nr = atoi(argv[1]);
@@ -388,7 +388,7 @@
 				VTY_NEWLINE);
 			return CMD_WARNING;
 		}
-		trx = &bts->trx[trx_nr];
+		trx = gsm_bts_trx_num(bts, trx_nr);
 	}
 	if (argc >= 3) {
 		ts_nr = atoi(argv[2]);
@@ -411,9 +411,9 @@
 		return CMD_SUCCESS;
 	}
 	for (bts_nr = 0; bts_nr < net->num_bts; bts_nr++) {
-		bts = &net->bts[bts_nr];
+		bts = gsm_bts_num(net, bts_nr);
 		for (trx_nr = 0; trx_nr < bts->num_trx; trx_nr++) {
-			trx = &bts->trx[trx_nr];
+			trx = gsm_bts_trx_num(bts, trx_nr);
 			for (ts_nr = 0; ts_nr < TRX_NR_TS; ts_nr++) {
 				ts = &trx->ts[ts_nr];
 				for (lchan_nr = 0; lchan_nr < TS_MAX_LCHAN;
@@ -567,13 +567,13 @@
 				VTY_NEWLINE);
 			return CMD_WARNING;
 		}
-		bts = &net->bts[bts_nr];
+		bts = gsm_bts_num(net, bts_nr);
 		bts_paging_dump_vty(vty, bts);
 		
 		return CMD_SUCCESS;
 	}
 	for (bts_nr = 0; bts_nr < net->num_bts; bts_nr++) {
-		bts = &net->bts[bts_nr];
+		bts = gsm_bts_num(net, bts_nr);
 		bts_paging_dump_vty(vty, bts);
 	}
 
@@ -612,14 +612,19 @@
 	int bts_nr = atoi(argv[0]);
 	struct gsm_bts *bts;
 
-	if (bts_nr >= GSM_MAX_BTS) {
-		vty_out(vty, "%% This Version of OpenBSC only supports %u BTS%s",
-			GSM_MAX_BTS, VTY_NEWLINE);
+	if (bts_nr > gsmnet->num_bts) {
+		vty_out(vty, "%% The next unused BTS number is %u%s",
+			gsmnet->num_bts, VTY_NEWLINE);
 		return CMD_WARNING;
-	}
-	bts = &gsmnet->bts[bts_nr];
-	if (bts_nr >= gsmnet->num_bts)
-		gsmnet->num_bts = bts_nr + 1;
+	} else if (bts_nr == gsmnet->num_bts) {
+		/* allocate a new one */
+		bts = gsm_bts_alloc(gsmnet, GSM_BTS_TYPE_UNKNOWN,
+				    HARDCODED_TSC, HARDCODED_BSIC);
+	} else 
+		bts = gsm_bts_num(gsmnet, bts_nr);
+
+	if (!bts)
+		return CMD_WARNING;
 
 	vty->index = bts;
 	vty->node = BTS_NODE;
@@ -748,16 +753,18 @@
 	struct gsm_bts *bts = vty->index;
 	struct gsm_bts_trx *trx;
 
-	if (trx_nr > BTS_MAX_TRX) {
-		vty_out(vty, "%% This version of OpenBSC only supports %u TRX%s",
-			BTS_MAX_TRX+1, VTY_NEWLINE);
+	if (trx_nr > bts->num_trx) {
+		vty_out(vty, "%% The next unused TRX number in this BTS is %u%s",
+			bts->num_trx, VTY_NEWLINE);
 		return CMD_WARNING;
-	}
-
-	if (trx_nr >= bts->num_trx)
-		bts->num_trx = trx_nr+1;
-
-	trx = &bts->trx[trx_nr];
+	} else if (trx_nr == bts->num_trx) {
+		/* we need to allocate a new one */
+		trx = gsm_bts_trx_alloc(bts);
+	} else 
+		trx = gsm_bts_trx_num(bts, trx_nr);
+	
+	if (!trx)
+		return CMD_WARNING;
 
 	vty->index = trx;
 	vty->node = TRX_NODE;
@@ -947,7 +954,7 @@
 	install_node(&trx_node, dummy_config_write);
 	install_default(TRX_NODE);
 	install_element(TRX_NODE, &cfg_trx_arfcn_cmd);
-	install_element(TRX_NODE, &cfg_trx_max_power_red);
+	install_element(TRX_NODE, &cfg_trx_max_power_red_cmd);
 
 	install_element(TRX_NODE, &cfg_ts_cmd);
 	install_node(&ts_node, dummy_config_write);
diff --git a/openbsc/tests/channel/Makefile.am b/openbsc/tests/channel/Makefile.am
index 60defe0..5a3477c 100644
--- a/openbsc/tests/channel/Makefile.am
+++ b/openbsc/tests/channel/Makefile.am
@@ -9,6 +9,7 @@
 	$(top_srcdir)/src/debug.c \
 	$(top_srcdir)/src/timer.c \
 	$(top_srcdir)/src/select.c \
+	$(top_srcdir)/src/talloc.c \
 	$(top_srcdir)/src/gsm_data.c
 channel_test_LDADD = -ldl -ldbi
 
diff --git a/openbsc/tests/channel/channel_test.c b/openbsc/tests/channel/channel_test.c
index 1787e35..ab165c7 100644
--- a/openbsc/tests/channel/channel_test.c
+++ b/openbsc/tests/channel/channel_test.c
@@ -19,6 +19,7 @@
  */
 
 #include <stdio.h>
+#include <stdlib.h>
 
 #include <assert.h>
 
@@ -47,20 +48,24 @@
 
 int main(int argc, char** argv)
 {
-	struct gsm_network network;
+	struct gsm_network *network;
+	struct gsm_bts *bts;
 
 	printf("Testing the gsm_subscriber chan logic\n");
 
 	/* Create a dummy network */
-	network.bts[0].location_area_code = 23;
-	network.bts[0].network = &network;
+	network = gsm_network_init(1, 1, NULL);
+	if (!network)
+		exit(1);
+	bts = gsm_bts_alloc(network, GSM_BTS_TYPE_BS11, 0, 0);
+	bts->location_area_code = 23;
 
 	/* Create a dummy subscriber */
 	struct gsm_subscriber *subscr = subscr_alloc();
 	subscr->lac = 23;
 
 	/* Ask for a channel... */
-	subscr_get_channel(subscr, &network, RSL_CHANNEED_TCH_F, subscr_cb, (void*)0x2342L);
+	subscr_get_channel(subscr, network, RSL_CHANNEED_TCH_F, subscr_cb, (void*)0x2342L);
 
 	while (1) {
 		bsc_select_main(0);
diff --git a/openbsc/tests/sms/sms_test.c b/openbsc/tests/sms/sms_test.c
index dfc43cf..5c3c7c7 100644
--- a/openbsc/tests/sms/sms_test.c
+++ b/openbsc/tests/sms/sms_test.c
@@ -92,7 +92,7 @@
 
 	for(i=0;i<SMS_NUM;i++) {
 		/* Setup SMS msgb */
-		msg = msgb_alloc(sms_data[i].len);
+		msg = msgb_alloc(sms_data[i].len, "SMS");
 		sms = msgb_put(msg, sms_data[i].len);
 
 		memcpy(sms, sms_data[i].data, sms_data[i].len);
diff --git a/wireshark/abis_oml.patch b/wireshark/abis_oml.patch
new file mode 100644
index 0000000..4b89916
--- /dev/null
+++ b/wireshark/abis_oml.patch
@@ -0,0 +1,1463 @@
+Index: wireshark/epan/dissectors/Makefile.common
+===================================================================
+--- wireshark.orig/epan/dissectors/Makefile.common	2009-06-24 13:35:12.000000000 +0200
++++ wireshark/epan/dissectors/Makefile.common	2009-06-24 13:35:54.000000000 +0200
+@@ -874,6 +874,7 @@
+ #
+ DIRTY_DISSECTOR_SRC =	\
+ 	packet-abis_ip.c	\
++	packet-abis_oml.c	\
+ 	packet-k12.c 		\
+ 	packet-nbd.c		\
+ 	packet-sccp.c		\
+Index: wireshark/epan/dissectors/packet-abis_oml.c
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ wireshark/epan/dissectors/packet-abis_oml.c	2009-06-24 15:26:50.000000000 +0200
+@@ -0,0 +1,776 @@
++/* packet-abis_oml.c
++ * Routines for packet dissection of GSM A-bis over IP (3GPP TS 12.21)
++ * Copyright 2009 by Harald Welte <laforge@gnumonks.org>
++ * based on A-bis OML code in OpenBSC
++ *
++ * $Id$
++ *
++ * Wireshark - Network traffic analyzer
++ * By Gerald Combs <gerald@wireshark.org>
++ * Copyright 1998 Gerald Combs
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * as published by the Free Software Foundation; either version 2
++ * of the License, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
++ */
++
++#ifdef HAVE_CONFIG_H
++# include "config.h"
++#endif
++
++#include <glib.h>
++
++#include <epan/packet.h>
++#include <epan/emem.h>
++
++#include "packet-abis_oml.h"
++
++/* initialize the protocol and registered fields */
++static int proto_abis_oml = -1;
++
++/* OML header */
++static int hf_oml_msg_disc = -1;
++static int hf_oml_placement = -1;
++static int hf_oml_sequence = -1;
++static int hf_oml_length = -1;
++/* FOM header */
++static int hf_oml_fom_msgtype = -1;
++static int hf_oml_fom_objclass = -1;
++static int hf_oml_fom_inst_bts = -1;
++static int hf_oml_fom_inst_trx = -1;
++static int hf_oml_fom_inst_ts = -1;
++static int hf_oml_fom_attr_tag = -1;
++static int hf_oml_fom_attr_len = -1;
++static int hf_oml_fom_attr_val = -1;
++/* FOM attributes */
++static int hf_attr_adm_state = -1;
++static int hf_attr_oper_state = -1;
++static int hf_attr_avail_state = -1;
++static int hf_attr_event_type = -1;
++static int hf_attr_severity = -1;
++
++/* initialize the subtree pointers */
++static int ett_oml = -1;
++static int ett_oml_fom = -1;
++static int ett_oml_fom_att = -1;
++
++static proto_tree *top_tree;
++
++/* TS 12.21 Chapter 8.1 / TS 08.59 */
++static const value_string oml_msg_disc_vals[] = {
++	{ ABIS_OM_MDISC_FOM,	"Formatted O&M" },
++	{ ABIS_OM_MDISC_MMI,	"MMI Transfer" },
++	{ ABIS_OM_MDISC_TRAU,	"TRAU O&M" },
++	{ ABIS_OM_MDISC_MANUF,	"Manufacturer specific" },
++};
++
++/* TS 12.21 Chapter 8.1.1 */
++static const value_string oml_placement_vals[] = {
++	{ ABIS_OM_PLACEMENT_ONLY,	"Only" },
++	{ ABIS_OM_PLACEMENT_FIRST,	"First" },
++	{ ABIS_OM_PLACEMENT_MIDDLE,	"Middle" },
++	{ ABIS_OM_PLACEMENT_LAST,	"Last" },
++};
++
++/* TS 12.21 Chapter 9.2 */
++static const value_string oml_fom_msgtype_vals[] = {
++	{ NM_MT_LOAD_INIT,		"Software Load Init" },
++	{ NM_MT_LOAD_INIT_ACK,		"Software Load Init ACK" },
++	{ NM_MT_LOAD_INIT_NACK,		"Software Load Init NACK" },
++	{ NM_MT_LOAD_SEG,		"Software Load Segment" },
++	{ NM_MT_LOAD_SEG_ACK,		"Software Load Segment ACK" },
++	{ NM_MT_LOAD_END,		"Software Load End" },
++	{ NM_MT_LOAD_END_ACK,		"Software Load End ACK" },
++	{ NM_MT_LOAD_END_NACK,		"Software Load End NACK" },
++	{ NM_MT_SW_ACT_REQ,		"Software Activate Request" },
++	{ NM_MT_SW_ACT_REQ_ACK,		"Software Activate Request ACK" },
++	{ NM_MT_SW_ACT_REQ_NACK,	"Software Activate Request NACK" },
++	{ NM_MT_ACTIVATE_SW,		"Activate Software" },
++	{ NM_MT_ACTIVATE_SW_ACK,	"Activate Software ACK" },
++	{ NM_MT_ACTIVATE_SW_NACK,	"Activate Software NACK" },
++	{ NM_MT_SW_ACTIVATED_REP,	"Software Activated Report" },
++	{ NM_MT_ESTABLISH_TEI,		"Establish TEI" },
++	{ NM_MT_ESTABLISH_TEI_ACK,	"Establish TEI ACK" },
++	{ NM_MT_ESTABLISH_TEI_NACK,	"Establish TEI NACK" },
++	{ NM_MT_CONN_TERR_SIGN,		"Connect Terrestrial Signalling" },
++	{ NM_MT_CONN_TERR_SIGN_ACK,	"Connect Terrestrial Signalling ACK" },
++	{ NM_MT_CONN_TERR_SIGN_NACK,	"Connect Terrestrial Signalling NACK" },
++	{ NM_MT_DISC_TERR_SIGN,		"Disconnect Terrestrial Signalling" },
++	{ NM_MT_DISC_TERR_SIGN_ACK,	"Disconnect Terrestrial Signalling ACK" },
++	{ NM_MT_DISC_TERR_SIGN_NACK,	"Disconnect Terrestrial Signalling NACK" },
++	{ NM_MT_CONN_TERR_TRAF,		"Connect Terrestrial Traffic" },
++	{ NM_MT_CONN_TERR_TRAF_ACK,	"Connect Terrestrial Traffic ACK" },
++	{ NM_MT_CONN_TERR_TRAF_NACK,	"Connect Terrestrial Traffic NACK" },
++	{ NM_MT_DISC_TERR_TRAF,		"Disconnect Terrestrial Traffic" },
++	{ NM_MT_DISC_TERR_TRAF_ACK,	"Disconnect Terrestrial Traffic ACK" },
++	{ NM_MT_DISC_TERR_TRAF_NACK,	"Disconnect Terrestrial Traffic NACK" },
++	{ NM_MT_CONN_MDROP_LINK,	"Connect Multi-Drop Link" },
++	{ NM_MT_CONN_MDROP_LINK_ACK,	"Connect Multi-Drop Link ACK" },
++	{ NM_MT_CONN_MDROP_LINK_NACK,	"Connect Multi-Drop Link NACK" },
++	{ NM_MT_DISC_MDROP_LINK,	"Disconnect Multi-Drop Link" },
++	{ NM_MT_DISC_MDROP_LINK_ACK,	"Disconnect Multi-Drop Link ACK" },
++	{ NM_MT_DISC_MDROP_LINK_NACK,	"Disconnect Multi-Drop Link NACK" },
++	{ NM_MT_SET_BTS_ATTR,		"Set BTS Attributes" },
++	{ NM_MT_SET_BTS_ATTR_ACK,	"Set BTS Attributes ACK" },
++	{ NM_MT_SET_BTS_ATTR_NACK,	"Set BTS Attributes NACK" },
++	{ NM_MT_SET_RADIO_ATTR,		"Set Radio Carrier Attributes" },
++	{ NM_MT_SET_RADIO_ATTR_ACK,	"Set Radio Carrier Attributes ACK" },
++	{ NM_MT_SET_RADIO_ATTR_NACK,	"Set Radio Carrier Attributes NACK" },
++	{ NM_MT_SET_CHAN_ATTR,		"Set Channel Attributes" },
++	{ NM_MT_SET_CHAN_ATTR_ACK,	"Set Channel Attributes ACK" },
++	{ NM_MT_SET_CHAN_ATTR_NACK,	"Set Channel Attributes NACK" },
++	{ NM_MT_PERF_TEST,		"Perform Test" },
++	{ NM_MT_PERF_TEST_ACK,		"Perform Test ACK" },
++	{ NM_MT_PERF_TEST_NACK,		"Perform Test NACK" },
++	{ NM_MT_TEST_REP,		"Test Report" },
++	{ NM_MT_SEND_TEST_REP,		"Send Test Report" },
++	{ NM_MT_SEND_TEST_REP_ACK,	"Send Test Report ACK" },
++	{ NM_MT_SEND_TEST_REP_NACK,	"Send Test Report NACK" },
++	{ NM_MT_STOP_TEST,		"Stop Test" },
++	{ NM_MT_STOP_TEST_ACK,		"Stop Test ACK" },
++	{ NM_MT_STOP_TEST_NACK,		"Stop Test NACK" },
++	{ NM_MT_STATECHG_EVENT_REP,	"State Changed Event Report" },
++	{ NM_MT_FAILURE_EVENT_REP,	"Failure Event Report" },
++	{ NM_MT_STOP_EVENT_REP,		"Stop Sending Event Reports" },
++	{ NM_MT_STOP_EVENT_REP_ACK,	"Stop Sending Event Reports ACK" },
++	{ NM_MT_STOP_EVENT_REP_NACK,	"Stop Sending Event Reports NACK" },
++	{ NM_MT_REST_EVENT_REP,		"Restart Sending Event Reports" },
++	{ NM_MT_REST_EVENT_REP_ACK,	"Restart Sending Event Reports ACK" },
++	{ NM_MT_REST_EVENT_REP_NACK,	"Restart Sending Event Reports NACK" },
++	{ NM_MT_CHG_ADM_STATE,		"Change Administrative State" },
++	{ NM_MT_CHG_ADM_STATE_ACK,	"Change Administrative State ACK" },
++	{ NM_MT_CHG_ADM_STATE_NACK,	"Change Administrative State NACK" },
++	{ NM_MT_CHG_ADM_STATE_REQ,	"Change Administrative State Request" },
++	{ NM_MT_CHG_ADM_STATE_REQ_ACK,	"Change Administrative State Request ACK" },
++	{ NM_MT_CHG_ADM_STATE_REQ_NACK,	"Change Administrative State Request NACK" },
++	{ NM_MT_REP_OUTST_ALARMS,	"Report Outstanding Alarms" },
++	{ NM_MT_REP_OUTST_ALARMS_ACK,	"Report Outstanding Alarms ACK" },
++	{ NM_MT_REP_OUTST_ALARMS_NACK,	"Report Outstanding Alarms NACK" },
++	{ NM_MT_CHANGEOVER,		"Changeover" },
++	{ NM_MT_CHANGEOVER_ACK,		"Changeover ACK" },
++	{ NM_MT_CHANGEOVER_NACK,	"Changeover NACK" },
++	{ NM_MT_OPSTART,		"Opstart" },
++	{ NM_MT_OPSTART_ACK,		"Opstart ACK" },
++	{ NM_MT_OPSTART_NACK,		"Opstart NACK" },
++	{ NM_MT_REINIT,			"Reinitialize" },
++	{ NM_MT_REINIT_ACK,		"Reinitialize ACK" },
++	{ NM_MT_REINIT_NACK,		"Reinitialize NACK" },
++	{ NM_MT_SET_SITE_OUT,		"Set Site Outputs" },
++	{ NM_MT_SET_SITE_OUT_ACK,	"Set Site Outputs ACK" },
++	{ NM_MT_SET_SITE_OUT_NACK,	"Set Site Outputs NACK" },
++	{ NM_MT_CHG_HW_CONF,		"Change HW Configuration" },
++	{ NM_MT_CHG_HW_CONF_ACK,	"Change HW Configuration ACK" },
++	{ NM_MT_CHG_HW_CONF_NACK,	"Change HW Configuration NACK" },
++	{ NM_MT_MEAS_RES_REQ,		"Measurement Result Request" },
++	{ NM_MT_MEAS_RES_RESP,		"Measurement Result Response" },
++	{ NM_MT_STOP_MEAS,		"Stop Measurement" },
++	{ NM_MT_START_MEAS,		"Start Measurement" },
++	{ NM_MT_GET_ATTR,		"Get Attributes" },
++	{ NM_MT_GET_ATTR_RESP,		"Get Attributes Response" },
++	{ NM_MT_GET_ATTR_NACK,		"Get Attributes NACK" },
++	{ NM_MT_SET_ALARM_THRES,	"Set Alarm Threshold" },
++	{ NM_MT_SET_ALARM_THRES_ACK,	"Set Alarm Threshold ACK" },
++	{ NM_MT_SET_ALARM_THRES_NACK,	"Set Alarm Threshold NACK" },
++	/* proprietary, not in the standard */
++	{ NM_MT_IPACC_RESTART,		"IPA Restart" },
++	{ NM_MT_IPACC_RESTART_ACK,	"IPA Restart ACK" },
++	{ NM_MT_IPACC_RSL_CONNECT,	"IPA RSL Connect" },
++	{ NM_MT_IPACC_RSL_CONNECT_ACK,	"IPA RSL Connect ACK" },
++	{ NM_MT_IPACC_RSL_CONNECT_NACK,	"IPA RSL Connect NACK" },
++	{ NM_MT_IPACC_SET_NVATTR,	"IPA Set NVRAM Attributes" },
++	{ NM_MT_IPACC_SET_NVATTR_ACK,	"IPA Set NVRAM Attributes ACK" },
++	{ NM_MT_IPACC_SET_NVATTR_NACK,	"IPA Set NVRAM Attributes NACK" },
++	{ NM_MT_IPACC_GET_NVATTR,	"IPA Get NVRAM Attributes" },
++	{ NM_MT_IPACC_GET_NVATTR_ACK,	"IPA Get NVRAM Attributes ACK" },
++	{ NM_MT_IPACC_GET_NVATTR_NACK,	"IPA Get NVRAM Attributes NACK" },
++	{ NM_MT_BS11_RESET_RESOURCE,	"SIE Reset Resource" },
++	{ NM_MT_BS11_BEGIN_DB_TX,	"SIE Begin Database Transmission" },
++	{ NM_MT_BS11_BEGIN_DB_TX_ACK,	"SIE Begin Database Transmission ACK" },
++	{ NM_MT_BS11_BEGIN_DB_TX_NACK,	"SIE Begin Database Transmission NACK" },
++	{ NM_MT_BS11_END_DB_TX,		"SIE End Database Transmission" },
++	{ NM_MT_BS11_END_DB_TX_ACK,	"SIE End Database Transmission ACK" },
++	{ NM_MT_BS11_END_DB_TX_NACK,	"SIE End Database Transmission NACK" },
++	{ NM_MT_BS11_CREATE_OBJ,	"SIE Create Object" },
++	{ NM_MT_BS11_CREATE_OBJ_ACK,	"SIE Create Object ACK" },
++	{ NM_MT_BS11_CREATE_OBJ_NACK,	"SIE Create Object NACK" },
++	{ NM_MT_BS11_DELETE_OBJ,	"SIE Delete Object" },
++	{ NM_MT_BS11_DELETE_OBJ_ACK,	"SIE Delete Object ACK" },
++	{ NM_MT_BS11_DELETE_OBJ_NACK,	"SIE Delete Object NACK" },
++	{ NM_MT_BS11_GET_STATE,		"SIE Get State" },
++	{ NM_MT_BS11_GET_STATE_ACK,	"SIE Get State ACK" },
++	{ NM_MT_BS11_LMT_LOGON,		"SIE LMT Logon" },
++	{ NM_MT_BS11_LMT_LOGON_ACK,	"SIE LMT Logon ACK" },
++	{ NM_MT_BS11_RESTART,		"SIE Restart" },
++	{ NM_MT_BS11_RESTART_ACK,	"SIE Restart ACK" },
++	{ NM_MT_BS11_DISCONNECT,	"SIE Disconnect BTS" },
++	{ NM_MT_BS11_DISCONNECT_ACK,	"SIE Disconnect BTS ACK" },
++	{ NM_MT_BS11_LMT_LOGOFF,	"SIE LMT Logoff" },
++	{ NM_MT_BS11_LMT_LOGOFF_ACK,	"SIE LMT Logoff ACK" },
++	{ NM_MT_BS11_RECONNECT,		"SIE Reconnect BTS" },
++	{ NM_MT_BS11_RECONNECT_ACK,	"SIE Reconnect BTS ACK" },
++};
++
++/* TS 12.21 Section 9.2: Object Class */
++static const value_string oml_fom_objclass_vals[] = {
++	{ NM_OC_SITE_MANAGER,		"BTS Site Manager" },
++	{ NM_OC_BTS,			"BTS" },
++	{ NM_OC_RADIO_CARRIER,		"Radio Carrier" },
++	{ NM_OC_CHANNEL,		"Radio Channel" },
++	{ NM_OC_BASEB_TRANSC,		"Baseband Transceiver" },
++	/* proprietary, vendor specific */
++	{ NM_OC_BS11_ADJC,		"SIE Adjacend Channel" },
++	{ NM_OC_BS11_HANDOVER,		"SIE Handover" },
++	{ NM_OC_BS11_PWR_CTRL,		"SIE Power Control" },
++	{ NM_OC_BS11_BTSE,		"SIE BTSE" },
++	{ NM_OC_BS11_RACK,		"SIE Rack" },
++	{ NM_OC_BS11,			"SIE SiemensHW" },
++	{ NM_OC_BS11_TEST,		"SIE Test" },
++	{ NM_OC_BS11_ENVABTSE,		"SIE EnvaBTSE" },
++	{ NM_OC_BS11_BPORT,		"SIE BPort" },
++	{ NM_OC_GPRS_NSE,		"GPRS NSE" },
++	{ NM_OC_GPRS_CELL,		"GPRS Cell" },
++	{ NM_OC_GPRS_NSVC0,		"GPRS NSVC0" },
++	{ NM_OC_GPRS_NSVC1,		"GPRS NSVC1" },
++	{ NM_OC_NULL,			"NULL" },
++};
++
++/* TS 12.21 Section 9.4: Attributes */
++static const value_string oml_fom_attr_vals[] = {
++	{ NM_ATT_ABIS_CHANNEL,		"A-bis Channel" },
++	{ NM_ATT_ADD_INFO,		"Additional Information" },
++	{ NM_ATT_ADD_TEXT,		"Additional Text" },
++	{ NM_ATT_ADM_STATE,		"Administrative State" },
++	{ NM_ATT_ARFCN_LIST,		"ARFCN List" },
++	{ NM_ATT_AUTON_REPORT,		"Autonomously Report" },
++	{ NM_ATT_AVAIL_STATUS,		"Availability Status" },
++	{ NM_ATT_BCCH_ARFCN,		"BCCH ARFCN" },
++	{ NM_ATT_BSIC,			"BSIC" },
++	{ NM_ATT_BTS_AIR_TIMER,		"BTS Air Timer" },
++	{ NM_ATT_CCCH_L_I_P,		"CCCH Load Indication Period" },
++	{ NM_ATT_CCCH_L_T,		"CCCH Load Threshold" },
++	{ NM_ATT_CHAN_COMB,		"Channel Combination" },
++	{ NM_ATT_CONN_FAIL_CRIT,	"Connection Fail Criterion" },
++	{ NM_ATT_DEST,			"Destination" },
++	{ NM_ATT_EVENT_TYPE,		"Event Type" },
++	{ NM_ATT_FILE_ID,		"File ID" },
++	{ NM_ATT_FILE_VERSION,		"File Version" },
++	{ NM_ATT_GSM_TIME,		"GSM Time" },
++	{ NM_ATT_HSN,			"HSN" },
++	{ NM_ATT_HW_CONFIG,		"HW Configuration" },
++	{ NM_ATT_HW_DESC,		"HW Description" },
++	{ NM_ATT_INTAVE_PARAM,		"Intave Parameter" },
++	{ NM_ATT_LIST_REQ_ATTR,		"List of required Attributes" },
++	{ NM_ATT_MAIO,			"MAIO" },
++	{ NM_ATT_MANUF_STATE,		"Manufacturer Dependent State" },
++	{ NM_ATT_MANUF_THRESH,		"Manufacturer Dependent Thresholds" },
++	{ NM_ATT_MANUF_ID,		"Manufacturer Id" },
++	{ NM_ATT_MAX_TA,		"Maximum Timing Advance" },
++	{ NM_ATT_MDROP_LINK,		"Multi-drop BSC Link" },
++	{ NM_ATT_MDROP_NEXT,		"Multi-drop next BTS Link" },
++	{ NM_ATT_NACK_CAUSES,		"NACK Causes" },
++	{ NM_ATT_NY1,			"Ny1" },
++	{ NM_ATT_OPER_STATE,		"Operational State" },
++	{ NM_ATT_OVERL_PERIOD,		"Overload Period" },
++	{ NM_ATT_PHYS_CONF,		"Physical Config" },
++	{ NM_ATT_POWER_CLASS,		"Power Class" },
++	{ NM_ATT_POWER_THRESH,		"Power Output Thresholds" },
++	{ NM_ATT_PROB_CAUSE,		"Probable Cause" },
++	{ NM_ATT_RACH_B_THRESH,		"RACH Busy Threshold" },
++	{ NM_ATT_LDAVG_SLOTS,		"RACH Load Averaging Slots" },
++	{ NM_ATT_RAD_SUBC,		"Radio Sub Channel" },
++	{ NM_ATT_RF_MAXPOWR_R,		"RF Max Power Reduction" },
++	{ NM_ATT_SITE_INPUTS,		"Site Inputs" },
++	{ NM_ATT_SITE_OUTPUTS,		"Site Outputs" },
++	{ NM_ATT_SOURCE,		"Source" },
++	{ NM_ATT_SPEC_PROB,		"Specific Problems" },
++	{ NM_ATT_START_TIME,		"Starting Time" },
++	{ NM_ATT_T200,			"T200" },
++	{ NM_ATT_TEI,			"TEI" },
++	{ NM_ATT_TEST_DUR,		"Test Duration" },
++	{ NM_ATT_TEST_NO,		"Test No" },
++	{ NM_ATT_TEST_REPORT,		"Test Report Info" },
++	{ NM_ATT_VSWR_THRESH,		"VSWR Thresholds " },
++	{ NM_ATT_WINDOW_SIZE,		"Window Size" },
++	{ NM_ATT_BS11_RSSI_OFFS,	"SIE RSSI Offset" },
++	{ NM_ATT_BS11_TXPWR,		"SIE TX Power" },
++	{ NM_ATT_BS11_DIVERSITY,	"SIE Diversity" },
++	{ NM_ATT_TSC,			"Training Sequence Code" },
++	{ NM_ATT_SW_CONFIG,		"SW Configuration" },
++	{ NM_ATT_SW_DESCR,		"SW Description" },
++	{ NM_ATT_SEVERITY,		"Perceived Severity" },
++	{ NM_ATT_GET_ARI,		"Get ARI" },
++	{ NM_ATT_HW_CONF_CHG,		"HW Configuration Change" },
++	{ NM_ATT_OUTST_ALARM,		"Outstanding Alarm" },
++	{ NM_ATT_FILE_DATA,		"File Data" },
++	{ NM_ATT_MEAS_RES,		"Measurement Result" },
++	{ NM_ATT_MEAS_TYPE,		"Measurement Type" },
++	{ NM_ATT_BS11_ESN_FW_CODE_NO,	"SIE ESN FW Code Number" },
++	{ NM_ATT_BS11_ESN_HW_CODE_NO,	"SIE ESN HW Code Number" },
++	{ NM_ATT_BS11_ESN_PCB_SERIAL,	"SIE ESN PCB Serial Number" },
++	{ NM_ATT_BS11_EXCESSIVE_DISTANCE, "SIE Excessive Distance" },
++	{ NM_ATT_BS11_ALL_TEST_CATG,	"SIE All Test Categories" },
++	{ NM_ATT_BS11_BTSLS_HOPPING,	"SIE BTS LS Hopping" },
++	{ NM_ATT_BS11_CELL_ALLOC_NR,	"SIE Cell Allocation Number" },
++	{ NM_ATT_BS11_CELL_GLOBAL_ID,	"SIE Cell Global ID" },
++	{ NM_ATT_BS11_ENA_INTERF_CLASS,	"SIE Enable Interference Class" },
++	/* FIXME */
++	{ NM_ATT_BS11_ENA_MS_PWR_CTRL,	"SIE Enable MS Power Control" },
++	{ NM_ATT_BS11_ENA_PWR_BDGT_HO,	"SIE Enable Power Budget HO" },
++	{ NM_ATT_BS11_ENA_RXLEV_HO,	"SIE Enable RxLevel HO" },
++	{ NM_ATT_BS11_ENA_RXQUAL_HO,	"SIE Enable RxQual HO" },
++	{ NM_ATT_BS11_FACCH_QUAL,	"SIE FACCH Quality" },
++	{ NM_ATT_IPACC_RSL_BSC_IP,	"IPA BSC RSL IP Address" },
++	{ NM_ATT_IPACC_RSL_BSC_PORT,	"IPA BSC RSL TCP Port" },
++	{ NM_ATT_IPACC_LOCATION,	"IPA Location Name" },
++	{ NM_ATT_IPACC_UNIT_ID,		"IPA Unit ID" },
++	{ NM_ATT_IPACC_UNIT_NAME,	"IPA Unit Name" },
++	{ NM_ATT_IPACC_PRIM_OML_IP,	"IPA Primary OML IP Address" },
++	{ NM_ATT_IPACC_SEC_OML_IP,	"IPA Secondary OML IP Address" },
++	/* FIXME: More SIE */
++};
++
++/* Section 9.4.4: Administrative State */
++static const value_string oml_adm_state_vals[] = {
++	{ NM_STATE_LOCKED,		"Locked" },
++	{ NM_STATE_UNLOCKED,		"Unlocked" },
++	{ NM_STATE_SHUTDOWN,		"Shutdown" },
++	{ NM_STATE_NULL,		"Null" },
++};
++
++static const value_string oml_oper_state_vals[] = {
++	{ 1,	"Disabled" },
++	{ 2,	"Enabled" },
++	{ 0xff,	"NULL" },
++};
++
++/* Section 9.4.7 Availability Status */
++static const value_string oml_avail_state_vals[] = {
++	{ 0,	"In test" },
++	{ 1,	"Failed" },
++	{ 2,	"Power off" },
++	{ 3,	"Off line" },
++	{ 5,	"Dependency" },
++	{ 6,	"Degraded" },
++	{ 7, 	"Not installed" },
++	{ 0xff,	"OK" },
++};
++
++/* Section 9.4.13: Channel Combination */
++static const value_string oml_chan_comb_vals[] = {
++	{ NM_CHANC_TCHFull,		"TCH/F" },
++	{ NM_CHANC_TCHHalf,		"TCH/H" },
++	{ NM_CHANC_TCHHalf2,		"TCH/H 2" },
++	{ NM_CHANC_SDCCH,		"SDCCH" },
++	{ NM_CHANC_mainBCCH,		"Main BCCH" },
++	{ NM_CHANC_BCCHComb,		"Combined BCCH" },
++	{ NM_CHANC_BCCH,		"BCCH" },
++	{ NM_CHANC_BCCH_CBCH,		"BCCH+CBCH" },
++	{ NM_CHANC_SDCCH_CBCH,		"SDCCH+CBCH" },
++};
++
++/* Section 9.4.16: Event Type */
++static const value_string oml_event_type_vals[] = {
++	{ NM_EVT_COMM_FAIL,		"Communication Failure" },
++	{ NM_EVT_QOS_FAIL,		"QoS Failure" },
++	{ NM_EVT_PROC_FAIL,		"Processor Failure" },
++	{ NM_EVT_EQUIP_FAIL,		"Equipment Failure" },
++	{ NM_EVT_ENV_FAIL,		"Environment Failure" },
++};
++
++/* Section 9.4.63: Perceived Severity */
++static const value_string oml_severity_vals[] = {
++	{ NM_SEVER_CEASED,		"Ceased" },
++	{ NM_SEVER_CRITICAL,		"Critical" },
++	{ NM_SEVER_MAJOR,		"Major" },
++	{ NM_SEVER_MINOR,		"Minor" },
++	{ NM_SEVER_WARNING,		"Warning" },
++	{ NM_SEVER_INDETERMINATE,	"Indeterminate" },
++};
++
++/* Section 9.4.36: NACK Causes */
++static const value_string oml_nack_cause[] = {
++	{ NM_NACK_INCORR_STRUCT,	"Incorrect message structure" },
++	{ NM_NACK_MSGTYPE_INVAL,	"Invalid message type value" },
++	{ NM_NACK_OBJCLASS_INVAL,	"Invalid Object class value" },
++	{ NM_NACK_OBJCLASS_NOTSUPP,	"Object Class not supported" },
++	{ NM_NACK_BTSNR_UNKN,		"BTS Number unknown" },
++	{ NM_NACK_TRXNR_UNKN,		"TRX Number unknown" },
++	{ NM_NACK_OBJINST_UNKN,		"Object Instance unknown" },
++	{ NM_NACK_ATTRID_INVAL,		"Invalid Attribute ID value" },
++	{ NM_NACK_ATTRID_NOTSUPP,	"Attribute ID not supported" },
++	{ NM_NACK_PARAM_RANGE,		"Parameter value out of range" },
++	{ NM_NACK_ATTRLIST_INCONSISTENT, "Inconsistency in Attribute list" },
++	{ NM_NACK_SPEC_IMPL_NOTSUPP,	"Specified Implementation not supported" },
++	{ NM_NACK_CANT_PERFORM,		"Message cannot be performed" },
++	{ NM_NACK_RES_NOTIMPL,		"Resource not implemented" },
++	{ NM_NACK_RES_NOTAVAIL,		"Resource not available" },
++	{ NM_NACK_FREQ_NOTAVAIL,	"Frequency not available" },
++	{ NM_NACK_TEST_NOTSUPP,		"Test not supported" },
++	{ NM_NACK_CAPACITY_RESTR,	"Capacity restrictions" },
++	{ NM_NACK_PHYSCFG_NOTPERFORM,	"Phys config cannot be performed" },
++	{ NM_NACK_TEST_NOTINIT,		"Test not initiated" },
++	{ NM_NACK_PHYSCFG_NOTRESTORE,	"Phys config cannot be restored" },
++	{ NM_NACK_TEST_NOSUCH,		"No such Test" },
++	{ NM_NACK_TEST_NOSTOP,		"Test cannot be stopped" },
++	{ NM_NACK_MSGINCONSIST_PHYSCFG,	"Message inconsisten with physical config" },
++	{ NM_NACK_FILE_INCOMPLETE,	"Complete file not received" },
++	{ NM_NACK_FILE_NOTAVAIL,	"File not available at destination" },
++	{ NM_NACK_FILE_NOTACTIVATE,	"File cannot be activated" },
++	{ NM_NACK_REQ_NOT_GRANT,	"Request not granted" },
++	{ NM_NACK_WAIT,			"Wait" },
++	{ NM_NACK_NOTH_REPORT_EXIST,	"Nothing reportable existing" },
++	{ NM_NACK_MEAS_NOTSUPP,		"Measurement not supported" },
++	{ NM_NACK_MEAS_NOTSTART,	"Measurement not started" },
++	{ 0xff,				"NULL" },
++};
++
++static gint
++dissect_oml_attrs(tvbuff_t *tvb, int base_offs, packet_info *pinfo,
++		  proto_tree *tree)
++{
++	int offset = base_offs;
++
++	while (tvb_reported_length_remaining(tvb, offset) != 0) {
++		guint8 tag, val8;
++		guint16 val16;
++		unsigned int len, len_len, hlen;
++		struct tlv_def *tdef;
++		proto_item *ti;
++		proto_tree *att_tree;
++
++		tag = tvb_get_guint8(tvb, offset);
++		tdef = &nm_att_tlvdef.def[tag];
++
++		switch (tdef->type) {
++		case TLV_TYPE_FIXED:
++			hlen = 1;
++			len_len = 0;
++			len = tdef->fixed_len;
++			break;
++		case TLV_TYPE_T:
++			hlen = 1;
++			len_len = 0;
++			len = 0;
++			break;
++		case TLV_TYPE_TV:
++			hlen = 1;
++			len_len = 0;
++			len = 1;
++			break;
++		case TLV_TYPE_TLV:
++			hlen = 2;
++			len_len = 1;
++			len = tvb_get_guint8(tvb, offset+1);
++			break;
++		case TLV_TYPE_TL16V:
++			hlen = 3;
++			len_len = 2;
++			len = tvb_get_guint8(tvb, offset+1) << 8 |
++						tvb_get_guint8(tvb, offset+2);
++			break;
++		}
++
++		ti = proto_tree_add_item(tree, hf_oml_fom_attr_tag, tvb,
++					 offset, 1, FALSE);
++		att_tree = proto_item_add_subtree(ti, ett_oml_fom_att);
++		proto_tree_add_uint(att_tree, hf_oml_fom_attr_len, tvb,
++				    offset+1, len_len, len);
++		offset += hlen;
++
++		switch (tag) {
++		/* parse only the most common IE for now */
++		case NM_ATT_ABIS_CHANNEL:
++			break;
++		case NM_ATT_ADM_STATE:
++			proto_tree_add_item(att_tree, hf_attr_adm_state, tvb,
++					    offset, len, FALSE);
++			if (check_col(pinfo->cinfo, COL_INFO)) {
++				val8 = tvb_get_guint8(tvb, offset);
++				col_append_fstr(pinfo->cinfo, COL_INFO, "%s ",
++						val_to_str(val8,
++							   oml_adm_state_vals,
++							   "%02x"));
++			}
++			break;
++		case NM_ATT_ARFCN_LIST:
++			break;
++		case NM_ATT_AVAIL_STATUS:
++			proto_tree_add_item(att_tree, hf_attr_avail_state, tvb,
++					    offset, len, FALSE);
++			if (check_col(pinfo->cinfo, COL_INFO)) {
++				/* Availability status can have length 0 */
++				if (len)
++					val8 = tvb_get_guint8(tvb, offset);
++				else
++					val8 = 0xff;
++				col_append_fstr(pinfo->cinfo, COL_INFO, "%s ",
++						val_to_str(val8,
++							   oml_avail_state_vals,
++							   "%02x"));
++			}
++
++			break;
++		case NM_ATT_BCCH_ARFCN:
++			break;
++		case NM_ATT_BSIC:
++			break;
++		case NM_ATT_CHAN_COMB:
++			break;
++		case NM_ATT_EVENT_TYPE:
++			proto_tree_add_item(att_tree, hf_attr_event_type, tvb,
++					    offset, len, FALSE);
++			break;
++		case NM_ATT_FILE_ID:
++			break;
++		case NM_ATT_FILE_VERSION:
++			break;
++		case NM_ATT_GSM_TIME:
++			break;
++		case NM_ATT_MANUF_STATE:
++			break;
++		case NM_ATT_OPER_STATE:
++			proto_tree_add_item(att_tree, hf_attr_oper_state, tvb,
++					    offset, len, FALSE);
++			if (check_col(pinfo->cinfo, COL_INFO)) {
++				val8 = tvb_get_guint8(tvb, offset);
++				col_append_fstr(pinfo->cinfo, COL_INFO, "%s ",
++						val_to_str(val8,
++							   oml_oper_state_vals,
++							   "%02x"));
++			}
++			break;
++		case NM_ATT_TEI:
++			break;
++		case NM_ATT_TSC:
++			break;
++		case NM_ATT_SEVERITY:
++			proto_tree_add_item(att_tree, hf_attr_severity, tvb,
++					    offset, len, FALSE);
++			break;
++
++		/* proprietary ip.access extensions */
++		case NM_ATT_IPACC_RSL_BSC_IP:
++			break;
++		case NM_ATT_IPACC_RSL_BSC_PORT:
++			break;
++		case NM_ATT_IPACC_LOCATION:
++			break;
++		case NM_ATT_IPACC_UNIT_ID:
++			break;
++		case NM_ATT_IPACC_UNIT_NAME:
++			break;
++		case NM_ATT_IPACC_PRIM_OML_IP:
++			break;
++		case NM_ATT_IPACC_SEC_OML_IP:
++			break;
++		default:
++			proto_tree_add_item(att_tree, hf_oml_fom_attr_val, tvb,
++					    offset, len, FALSE);
++		}
++		offset += len;
++	}
++	return offset;
++}
++
++static int
++dissect_oml_fom(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset)
++{
++	guint8 msg_type, obj_class, bts_nr, trx_nr, ts_nr;
++	proto_item *ti;
++	proto_tree *fom_tree;
++
++	msg_type = tvb_get_guint8(tvb, offset);
++	obj_class = tvb_get_guint8(tvb, offset+1);
++	bts_nr = tvb_get_guint8(tvb, offset+2);
++	trx_nr = tvb_get_guint8(tvb, offset+3);
++	ts_nr = tvb_get_guint8(tvb, offset+4);
++	if (check_col(pinfo->cinfo, COL_INFO)) {
++		col_append_fstr(pinfo->cinfo, COL_INFO, "%s(%02x,%02x,%02x) %s ",
++				val_to_str(obj_class, oml_fom_objclass_vals, "%02x"),
++				bts_nr, trx_nr, ts_nr,
++				val_to_str(msg_type, oml_fom_msgtype_vals,
++					   "unknown 0x%x"));
++	}
++	ti = proto_tree_add_item(tree, hf_oml_fom_msgtype, tvb, offset++, 1, FALSE);
++	fom_tree = proto_item_add_subtree(ti, ett_oml_fom);
++	proto_tree_add_item(fom_tree, hf_oml_fom_objclass, tvb, offset++, 1, FALSE);
++	proto_tree_add_item(fom_tree, hf_oml_fom_inst_bts, tvb, offset++, 1, FALSE);
++	proto_tree_add_item(fom_tree, hf_oml_fom_inst_trx, tvb, offset++, 1, FALSE);
++	proto_tree_add_item(fom_tree, hf_oml_fom_inst_ts, tvb, offset++, 1, FALSE);
++
++
++	/* dissect the TLV objects in the message body */
++	offset = dissect_oml_attrs(tvb, offset, pinfo, fom_tree);
++
++	return offset;
++}
++
++
++static void
++dissect_abis_oml(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
++{
++	proto_item *ti;
++	proto_tree *oml_tree;
++	guint8 msg_type;
++
++	int offset = 0;
++
++	if (check_col(pinfo->cinfo, COL_PROTOCOL))
++		col_set_str(pinfo->cinfo, COL_PROTOCOL, "OML");
++#if 0
++	if (check_col(pinfo->cinfo, COL_INFO))
++		col_clear(pinfo->cinfo, COL_INFO);
++#endif
++
++	top_tree = tree;
++	if (tree) {
++		u_int8_t msg_disc = tvb_get_guint8(tvb, offset);
++
++		ti = proto_tree_add_item(tree, proto_abis_oml, tvb, 0, -1, FALSE);
++		oml_tree = proto_item_add_subtree(ti, ett_oml);
++
++		proto_tree_add_item(oml_tree, hf_oml_msg_disc, tvb, offset++, 1, FALSE);
++		proto_tree_add_item(oml_tree, hf_oml_placement, tvb, offset++, 1, FALSE);
++		proto_tree_add_item(oml_tree, hf_oml_sequence, tvb, offset++, 1, FALSE);
++		proto_tree_add_item(oml_tree, hf_oml_length, tvb, offset++, 1, FALSE);
++
++		switch (msg_disc) {
++		case ABIS_OM_MDISC_FOM:
++			offset = dissect_oml_fom(tvb, pinfo, oml_tree, offset);
++			break;
++		case ABIS_OM_MDISC_MMI:
++		case ABIS_OM_MDISC_TRAU:
++		case ABIS_OM_MDISC_MANUF:
++		default:
++			break;
++		}
++	}
++}
++
++void
++proto_register_abis_oml(void)
++{
++	static hf_register_info hf[] = {
++		{ &hf_oml_msg_disc,
++			{ "Message Discriminator", "oml.msg_dsc",
++			  FT_UINT8, BASE_HEX, VALS(oml_msg_disc_vals), 0,
++			  "Message Discriminator", HFILL }
++		},
++		{ &hf_oml_placement,
++			{ "Placement Indicator", "oml.placement",
++			  FT_UINT8, BASE_HEX, VALS(oml_placement_vals), 0,
++			  "Placement Indicator", HFILL }
++		},
++		{ &hf_oml_sequence,
++			{ "Sequence Number", "oml.sequence",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  "Sequence Number", HFILL }
++		},
++		{ &hf_oml_length,
++			{ "Length Indicator", "oml.length",
++			  FT_UINT8, BASE_DEC, NULL, 0,
++			  "Length Indicator", HFILL }
++		},
++		{ &hf_oml_fom_msgtype,
++			{ "FOM Message Type", "oml.fom.msg_type",
++			  FT_UINT8, BASE_HEX, VALS(oml_fom_msgtype_vals), 0,
++			  "FOM Message Type", HFILL }
++		},
++		{ &hf_oml_fom_objclass,
++			{ "FOM Object Class", "oml.fom.obj_class",
++			  FT_UINT8, BASE_HEX, VALS(oml_fom_objclass_vals), 0,
++			  "FOM Object Class", HFILL }
++		},
++		{ &hf_oml_fom_inst_bts,
++			{ "FOM Object Instance BTS", "oml.fom.obj_inst.bts",
++			  FT_UINT8, BASE_DEC, NULL, 0,
++			  "FOM Object Instance TRX", HFILL }
++		},
++		{ &hf_oml_fom_inst_trx,
++			{ "FOM Object Instance TRX", "oml.fom.obj_inst.trx",
++			  FT_UINT8, BASE_DEC, NULL, 0,
++			  "FOM Object Instance TRX", HFILL }
++		},
++		{ &hf_oml_fom_inst_ts,
++			{ "FOM Object Instance TS", "oml.fom.obj_inst.ts",
++			  FT_UINT8, BASE_DEC, NULL, 0,
++			  "FOM Object Instance TS", HFILL }
++		},
++		{ &hf_oml_fom_attr_tag,
++			{ "FOM Attribute ID", "oml.fom.attr_id",
++			  FT_UINT8, BASE_HEX, VALS(oml_fom_attr_vals), 0,
++			  "FOM Attribute ID", HFILL }
++		},
++		{ &hf_oml_fom_attr_len,
++			{ "FOM Attribute Length", "oml.fom.attr_len",
++			  FT_UINT16, BASE_DEC, NULL, 0,
++			  "FOM Attribute Length", HFILL }
++		},
++		{ &hf_oml_fom_attr_val,
++			{ "FOM Attribute Value", "oml.fom.attr_val",
++			  FT_BYTES, BASE_HEX, NULL, 0,
++			  "FOM Attribute Value", HFILL }
++		},
++
++
++
++		/* OML Attributes */
++		{ &hf_attr_adm_state,
++			{ "Administrative State", "oml.fom.attr.adm_state",
++			  FT_UINT8, BASE_HEX, VALS(oml_adm_state_vals), 0,
++			  "Administrative State", HFILL }
++		},
++		{ &hf_attr_oper_state,
++			{ "Operational State", "oml.fom.attr.oper_state",
++			  FT_UINT8, BASE_HEX, VALS(oml_oper_state_vals), 0,
++			  "Operational State", HFILL }
++		},
++		{ &hf_attr_avail_state,
++			{ "Availability Status", "oml.fom.attr.avail_state",
++			  FT_UINT8, BASE_HEX, VALS(oml_avail_state_vals), 0,
++			  "Availability Status", HFILL }
++		},
++		{ &hf_attr_event_type,
++			{ "Event Type", "oml.fom.attr.event_type",
++			  FT_UINT8, BASE_HEX, VALS(oml_event_type_vals), 0,
++			  "Event Type", HFILL }
++		},
++		{ &hf_attr_severity,
++			{ "Severity", "oml.fom.attr.severity",
++			  FT_UINT8, BASE_HEX, VALS(oml_severity_vals), 0,
++			  "Severity", HFILL }
++		},
++	};
++	static gint *ett[] = {
++		&ett_oml,
++		&ett_oml_fom,
++		&ett_oml_fom_att,
++	};
++
++	proto_abis_oml = proto_register_protocol("GSM A-bis OML", "OML",
++						 "gsm_abis_oml");
++
++	proto_register_field_array(proto_abis_oml, hf, array_length(hf));
++
++	proto_register_subtree_array(ett, array_length(ett));
++
++	register_dissector("gsm_abis_oml", dissect_abis_oml, proto_abis_oml);
++}
++
++void
++proto_reg_handoff_abis_oml(void)
++{
++	dissector_handle_t abis_oml_handle;
++
++	abis_oml_handle = find_dissector("abis_oml");
++}
+Index: wireshark/epan/dissectors/packet-abis_oml.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ wireshark/epan/dissectors/packet-abis_oml.h	2009-06-24 13:35:54.000000000 +0200
+@@ -0,0 +1,665 @@
++/* GSM Network Management messages on the A-bis interface
++ * 3GPP TS 12.21 version 8.0.0 Release 1999 / ETSI TS 100 623 V8.0.0 */
++
++/* (C) 2008-2009 by Harald Welte <laforge@gnumonks.org>
++ * All Rights Reserved
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License along
++ * with this program; if not, write to the Free Software Foundation, Inc.,
++ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ */
++
++#ifndef __PACKET_ABIS_OML_H__
++#define __PACKET_ABIS_OML_H__
++
++#include <sys/types.h>
++
++/* From openbsc/include/openbsc/abis_nm.h */
++
++/* generic header in front of every OML message according to TS 08.59 */
++struct abis_om_hdr {
++	guint8	mdisc;
++	guint8	placement;
++	guint8	sequence;
++	guint8	length;
++	guint8	data[0];
++} __attribute__ ((packed));
++
++#define ABIS_OM_MDISC_FOM		0x80
++#define ABIS_OM_MDISC_MMI		0x40
++#define ABIS_OM_MDISC_TRAU		0x20
++#define ABIS_OM_MDISC_MANUF		0x10
++#define ABIS_OM_PLACEMENT_ONLY		0x80
++#define ABIS_OM_PLACEMENT_FIRST 	0x40
++#define ABIS_OM_PLACEMENT_MIDDLE	0x20
++#define ABIS_OM_PLACEMENT_LAST		0x10
++
++struct abis_om_obj_inst {
++	guint8	bts_nr;
++	guint8	trx_nr;
++	guint8	ts_nr;
++} __attribute__ ((packed));
++
++struct abis_om_fom_hdr {
++	guint8	msg_type;
++	guint8	obj_class;
++	struct abis_om_obj_inst	obj_inst;
++	guint8	data[0];
++} __attribute__ ((packed));
++
++#define ABIS_OM_FOM_HDR_SIZE	(sizeof(struct abis_om_hdr) + sizeof(struct abis_om_fom_hdr))
++
++/* Section 9.1: Message Types */
++enum abis_nm_msgtype {
++	/* SW Download Management Messages */
++	NM_MT_LOAD_INIT			= 0x01,
++	NM_MT_LOAD_INIT_ACK,
++	NM_MT_LOAD_INIT_NACK,
++	NM_MT_LOAD_SEG,
++	NM_MT_LOAD_SEG_ACK,
++	NM_MT_LOAD_ABORT,
++	NM_MT_LOAD_END,
++	NM_MT_LOAD_END_ACK,
++	NM_MT_LOAD_END_NACK,
++	NM_MT_SW_ACT_REQ,		/* BTS->BSC */
++	NM_MT_SW_ACT_REQ_ACK,
++	NM_MT_SW_ACT_REQ_NACK,
++	NM_MT_ACTIVATE_SW,		/* BSC->BTS */
++	NM_MT_ACTIVATE_SW_ACK,
++	NM_MT_ACTIVATE_SW_NACK,
++	NM_MT_SW_ACTIVATED_REP,		/* 0x10 */
++	/* A-bis Interface Management Messages */
++	NM_MT_ESTABLISH_TEI		= 0x21,
++	NM_MT_ESTABLISH_TEI_ACK,
++	NM_MT_ESTABLISH_TEI_NACK,
++	NM_MT_CONN_TERR_SIGN,
++	NM_MT_CONN_TERR_SIGN_ACK,
++	NM_MT_CONN_TERR_SIGN_NACK,
++	NM_MT_DISC_TERR_SIGN,
++	NM_MT_DISC_TERR_SIGN_ACK,
++	NM_MT_DISC_TERR_SIGN_NACK,
++	NM_MT_CONN_TERR_TRAF,
++	NM_MT_CONN_TERR_TRAF_ACK,
++	NM_MT_CONN_TERR_TRAF_NACK,
++	NM_MT_DISC_TERR_TRAF,
++	NM_MT_DISC_TERR_TRAF_ACK,
++	NM_MT_DISC_TERR_TRAF_NACK,
++	/* Transmission Management Messages */
++	NM_MT_CONN_MDROP_LINK		= 0x31,
++	NM_MT_CONN_MDROP_LINK_ACK,
++	NM_MT_CONN_MDROP_LINK_NACK,
++	NM_MT_DISC_MDROP_LINK,
++	NM_MT_DISC_MDROP_LINK_ACK,
++	NM_MT_DISC_MDROP_LINK_NACK,
++	/* Air Interface Management Messages */
++	NM_MT_SET_BTS_ATTR		= 0x41,
++	NM_MT_SET_BTS_ATTR_ACK,
++	NM_MT_SET_BTS_ATTR_NACK,
++	NM_MT_SET_RADIO_ATTR,
++	NM_MT_SET_RADIO_ATTR_ACK,
++	NM_MT_SET_RADIO_ATTR_NACK,
++	NM_MT_SET_CHAN_ATTR,
++	NM_MT_SET_CHAN_ATTR_ACK,
++	NM_MT_SET_CHAN_ATTR_NACK,
++	/* Test Management Messages */
++	NM_MT_PERF_TEST			= 0x51,
++	NM_MT_PERF_TEST_ACK,
++	NM_MT_PERF_TEST_NACK,
++	NM_MT_TEST_REP,
++	NM_MT_SEND_TEST_REP,
++	NM_MT_SEND_TEST_REP_ACK,
++	NM_MT_SEND_TEST_REP_NACK,
++	NM_MT_STOP_TEST,
++	NM_MT_STOP_TEST_ACK,
++	NM_MT_STOP_TEST_NACK,
++	/* State Management and Event Report Messages */
++	NM_MT_STATECHG_EVENT_REP	= 0x61,
++	NM_MT_FAILURE_EVENT_REP,
++	NM_MT_STOP_EVENT_REP,
++	NM_MT_STOP_EVENT_REP_ACK,
++	NM_MT_STOP_EVENT_REP_NACK,
++	NM_MT_REST_EVENT_REP,
++	NM_MT_REST_EVENT_REP_ACK,
++	NM_MT_REST_EVENT_REP_NACK,
++	NM_MT_CHG_ADM_STATE,
++	NM_MT_CHG_ADM_STATE_ACK,
++	NM_MT_CHG_ADM_STATE_NACK,
++	NM_MT_CHG_ADM_STATE_REQ,
++	NM_MT_CHG_ADM_STATE_REQ_ACK,
++	NM_MT_CHG_ADM_STATE_REQ_NACK,
++	NM_MT_REP_OUTST_ALARMS		= 0x93,
++	NM_MT_REP_OUTST_ALARMS_ACK,
++	NM_MT_REP_OUTST_ALARMS_NACK,
++	/* Equipment Management Messages */
++	NM_MT_CHANGEOVER		= 0x71,
++	NM_MT_CHANGEOVER_ACK,
++	NM_MT_CHANGEOVER_NACK,
++	NM_MT_OPSTART,
++	NM_MT_OPSTART_ACK,
++	NM_MT_OPSTART_NACK,
++	NM_MT_REINIT,
++	NM_MT_REINIT_ACK,
++	NM_MT_REINIT_NACK,
++	NM_MT_SET_SITE_OUT,		/* BS11: get alarm ?!? */
++	NM_MT_SET_SITE_OUT_ACK,
++	NM_MT_SET_SITE_OUT_NACK,
++	NM_MT_CHG_HW_CONF		= 0x90,
++	NM_MT_CHG_HW_CONF_ACK,
++	NM_MT_CHG_HW_CONF_NACK,
++	/* Measurement Management Messages */
++	NM_MT_MEAS_RES_REQ		= 0x8a,
++	NM_MT_MEAS_RES_RESP,
++	NM_MT_STOP_MEAS,
++	NM_MT_START_MEAS,
++	/* Other Messages */
++	NM_MT_GET_ATTR			= 0x81,
++	NM_MT_GET_ATTR_RESP,
++	NM_MT_GET_ATTR_NACK,
++	NM_MT_SET_ALARM_THRES,
++	NM_MT_SET_ALARM_THRES_ACK,
++	NM_MT_SET_ALARM_THRES_NACK,
++
++	NM_MT_IPACC_RESTART		= 0x87,
++	NM_MT_IPACC_RESTART_ACK,
++};
++
++enum abis_nm_msgtype_bs11 {
++	NM_MT_BS11_RESET_RESOURCE	= 0x74,
++
++	NM_MT_BS11_BEGIN_DB_TX		= 0xa3,
++	NM_MT_BS11_BEGIN_DB_TX_ACK,
++	NM_MT_BS11_BEGIN_DB_TX_NACK,
++	NM_MT_BS11_END_DB_TX		= 0xa6,
++	NM_MT_BS11_END_DB_TX_ACK,
++	NM_MT_BS11_END_DB_TX_NACK,
++	NM_MT_BS11_CREATE_OBJ		= 0xa9,
++	NM_MT_BS11_CREATE_OBJ_ACK,
++	NM_MT_BS11_CREATE_OBJ_NACK,
++	NM_MT_BS11_DELETE_OBJ		= 0xac,
++	NM_MT_BS11_DELETE_OBJ_ACK,
++	NM_MT_BS11_DELETE_OBJ_NACK,
++
++	NM_MT_BS11_SET_ATTR		= 0xd0,
++	NM_MT_BS11_SET_ATTR_ACK,
++	NM_MT_BS11_SET_ATTR_NACK,
++	NM_MT_BS11_LMT_SESSION		= 0xdc,
++
++	NM_MT_BS11_GET_STATE		= 0xe3,
++	NM_MT_BS11_GET_STATE_ACK,
++	NM_MT_BS11_LMT_LOGON		= 0xe5,
++	NM_MT_BS11_LMT_LOGON_ACK,
++	NM_MT_BS11_RESTART		= 0xe7,
++	NM_MT_BS11_RESTART_ACK,
++	NM_MT_BS11_DISCONNECT		= 0xe9,
++	NM_MT_BS11_DISCONNECT_ACK,
++	NM_MT_BS11_LMT_LOGOFF		= 0xec,
++	NM_MT_BS11_LMT_LOGOFF_ACK,
++	NM_MT_BS11_RECONNECT		= 0xf1,
++	NM_MT_BS11_RECONNECT_ACK,
++};
++
++enum abis_nm_msgtype_ipacc {
++	NM_MT_IPACC_RSL_CONNECT		= 0xe0,
++	NM_MT_IPACC_RSL_CONNECT_ACK,
++	NM_MT_IPACC_RSL_CONNECT_NACK,
++	NM_MT_IPACC_SET_NVATTR		= 0xef,
++	NM_MT_IPACC_SET_NVATTR_ACK,
++	NM_MT_IPACC_SET_NVATTR_NACK,
++	NM_MT_IPACC_GET_NVATTR		= 0xf2,
++	NM_MT_IPACC_GET_NVATTR_ACK,
++	NM_MT_IPACC_GET_NVATTR_NACK,
++};
++
++enum abis_nm_bs11_cell_alloc {
++	NM_BS11_CANR_GSM	= 0x00,
++	NM_BS11_CANR_DCS1800	= 0x01,
++};
++
++/* Section 9.2: Object Class */
++enum abis_nm_obj_class {
++	NM_OC_SITE_MANAGER		= 0x00,
++	NM_OC_BTS,
++	NM_OC_RADIO_CARRIER,
++	NM_OC_CHANNEL,
++	NM_OC_BASEB_TRANSC,
++	/* RFU: 05-FE */
++	NM_OC_BS11_ADJC			= 0xa0,
++	NM_OC_BS11_HANDOVER		= 0xa1,
++	NM_OC_BS11_PWR_CTRL		= 0xa2,
++	NM_OC_BS11_BTSE			= 0xa3,		/* LMT? */
++	NM_OC_BS11_RACK			= 0xa4,
++	NM_OC_BS11			= 0xa5,		/* 01: ALCO */
++	NM_OC_BS11_TEST			= 0xa6,
++	NM_OC_BS11_ENVABTSE		= 0xa8,
++	NM_OC_BS11_BPORT		= 0xa9,
++
++	NM_OC_GPRS_NSE			= 0xf0,
++	NM_OC_GPRS_CELL			= 0xf1,
++	NM_OC_GPRS_NSVC0		= 0xf2,
++	NM_OC_GPRS_NSVC1		= 0xf3,
++
++	NM_OC_NULL			= 0xff,
++};
++
++/* Section 9.4: Attributes */
++enum abis_nm_attr {
++	NM_ATT_ABIS_CHANNEL	= 0x01,
++	NM_ATT_ADD_INFO,
++	NM_ATT_ADD_TEXT,
++	NM_ATT_ADM_STATE,
++	NM_ATT_ARFCN_LIST,
++	NM_ATT_AUTON_REPORT,
++	NM_ATT_AVAIL_STATUS,
++	NM_ATT_BCCH_ARFCN,
++	NM_ATT_BSIC,
++	NM_ATT_BTS_AIR_TIMER,
++	NM_ATT_CCCH_L_I_P,
++	NM_ATT_CCCH_L_T,
++	NM_ATT_CHAN_COMB,
++	NM_ATT_CONN_FAIL_CRIT,
++	NM_ATT_DEST,
++	/* res */
++	NM_ATT_EVENT_TYPE	= 0x11, /* BS11: file data ?!? */
++	NM_ATT_FILE_ID,
++	NM_ATT_FILE_VERSION,
++	NM_ATT_GSM_TIME,
++	NM_ATT_HSN,
++	NM_ATT_HW_CONFIG,
++	NM_ATT_HW_DESC,
++	NM_ATT_INTAVE_PARAM,
++	NM_ATT_INTERF_BOUND,
++	NM_ATT_LIST_REQ_ATTR,
++	NM_ATT_MAIO,
++	NM_ATT_MANUF_STATE,
++	NM_ATT_MANUF_THRESH,
++	NM_ATT_MANUF_ID,
++	NM_ATT_MAX_TA,
++	NM_ATT_MDROP_LINK,	/* 0x20 */
++	NM_ATT_MDROP_NEXT,
++	NM_ATT_NACK_CAUSES,
++	NM_ATT_NY1,
++	NM_ATT_OPER_STATE,
++	NM_ATT_OVERL_PERIOD,
++	NM_ATT_PHYS_CONF,
++	NM_ATT_POWER_CLASS,
++	NM_ATT_POWER_THRESH,
++	NM_ATT_PROB_CAUSE,
++	NM_ATT_RACH_B_THRESH,
++	NM_ATT_LDAVG_SLOTS,
++	NM_ATT_RAD_SUBC,
++	NM_ATT_RF_MAXPOWR_R,
++	NM_ATT_SITE_INPUTS,
++	NM_ATT_SITE_OUTPUTS,
++	NM_ATT_SOURCE,		/* 0x30 */
++	NM_ATT_SPEC_PROB,
++	NM_ATT_START_TIME,
++	NM_ATT_T200,
++	NM_ATT_TEI,
++	NM_ATT_TEST_DUR,
++	NM_ATT_TEST_NO,
++	NM_ATT_TEST_REPORT,
++	NM_ATT_VSWR_THRESH,
++	NM_ATT_WINDOW_SIZE,
++	/* Res  */
++	NM_ATT_BS11_RSSI_OFFS	= 0x3d,
++	NM_ATT_BS11_TXPWR	= 0x3e,
++	NM_ATT_BS11_DIVERSITY	= 0x3f,
++	/* Res  */
++	NM_ATT_TSC		= 0x40,
++	NM_ATT_SW_CONFIG,
++	NM_ATT_SW_DESCR,
++	NM_ATT_SEVERITY,
++	NM_ATT_GET_ARI,
++	NM_ATT_HW_CONF_CHG,
++	NM_ATT_OUTST_ALARM,
++	NM_ATT_FILE_DATA,
++	NM_ATT_MEAS_RES,
++	NM_ATT_MEAS_TYPE,
++
++	NM_ATT_BS11_ESN_FW_CODE_NO	= 0x4c,
++	NM_ATT_BS11_ESN_HW_CODE_NO	= 0x4f,
++
++	NM_ATT_BS11_ESN_PCB_SERIAL	= 0x55,
++	NM_ATT_BS11_EXCESSIVE_DISTANCE	= 0x58,
++
++	NM_ATT_BS11_ALL_TEST_CATG	= 0x60,
++	NM_ATT_BS11_BTSLS_HOPPING,
++	NM_ATT_BS11_CELL_ALLOC_NR,
++	NM_ATT_BS11_CELL_GLOBAL_ID,
++	NM_ATT_BS11_ENA_INTERF_CLASS	= 0x66,
++	NM_ATT_BS11_ENA_INT_INTEC_HANDO	= 0x67,
++	NM_ATT_BS11_ENA_INT_INTRC_HANDO	= 0x68,
++	NM_ATT_BS11_ENA_MS_PWR_CTRL	= 0x69,
++	NM_ATT_BS11_ENA_PWR_BDGT_HO	= 0x6a,
++	NM_ATT_BS11_ENA_PWR_CTRL_RLFW	= 0x6b,
++	NM_ATT_BS11_ENA_RXLEV_HO	= 0x6c,
++	NM_ATT_BS11_ENA_RXQUAL_HO	= 0x6d,
++	NM_ATT_BS11_FACCH_QUAL		= 0x6e,
++
++	NM_ATT_IPACC_RSL_BSC_IP		= 0x80,
++	NM_ATT_IPACC_RSL_BSC_PORT	= 0x81,
++	NM_ATT_IPACC_LOCATION		= 0x8e,		/* string describing location */
++	NM_ATT_IPACC_UNIT_ID		= 0x91,		/* Site/BTS/TRX */
++	NM_ATT_IPACC_UNIT_NAME		= 0x93,		/* default: nbts-<mac-as-string> */
++	NM_ATT_IPACC_PRIM_OML_IP	= 0x95,
++	NM_ATT_IPACC_SEC_OML_IP		= 0x96,
++
++	NM_ATT_BS11_RF_RES_IND_PER	= 0x8f,
++
++	NM_ATT_BS11_RX_LEV_MIN_CELL	= 0x90,
++	NM_ATT_BS11_ABIS_EXT_TIME	= 0x91,
++	NM_ATT_BS11_TIMER_HO_REQUEST	= 0x92,
++	NM_ATT_BS11_TIMER_NCELL		= 0x93,
++	NM_ATT_BS11_TSYNC		= 0x94,
++	NM_ATT_BS11_TTRAU		= 0x95,
++	NM_ATT_BS11_EMRG_CFG_MEMBER	= 0x9b,
++	NM_ATT_BS11_TRX_AREA		= 0x9f,
++
++	NM_ATT_BS11_BCCH_RECONF		= 0xd7,
++	NM_ATT_BS11_BIT_ERR_THESH	= 0xa0,
++	NM_ATT_BS11_BOOT_SW_VERS	= 0xa1,
++	NM_ATT_BS11_CCLK_ACCURACY	= 0xa3,
++	NM_ATT_BS11_CCLK_TYPE		= 0xa4,
++	NM_ATT_BS11_INP_IMPEDANCE	= 0xaa,
++	NM_ATT_BS11_L1_PROT_TYPE	= 0xab,
++	NM_ATT_BS11_LINE_CFG		= 0xac,
++	NM_ATT_BS11_LI_PORT_1		= 0xad,
++	NM_ATT_BS11_LI_PORT_2		= 0xae,
++
++	NM_ATT_BS11_L1_REM_ALM_TYPE	= 0xb0,
++	NM_ATT_BS11_SW_LOAD_INTENDED	= 0xbb,
++	NM_ATT_BS11_SW_LOAD_SAFETY	= 0xbc,
++	NM_ATT_BS11_SW_LOAD_STORED	= 0xbd,
++
++	NM_ATT_BS11_VENDOR_NAME		= 0xc1,
++	NM_ATT_BS11_HOPPING_MODE	= 0xc5,
++	NM_ATT_BS11_LMT_LOGON_SESSION	= 0xc6,
++	NM_ATT_BS11_LMT_LOGIN_TIME	= 0xc7,
++	NM_ATT_BS11_LMT_USER_ACC_LEV	= 0xc8,
++	NM_ATT_BS11_LMT_USER_NAME	= 0xc9,
++
++	NM_ATT_BS11_L1_CONTROL_TS	= 0xd8,
++	NM_ATT_BS11_RADIO_MEAS_GRAN	= 0xdc,	/* in SACCH multiframes */
++	NM_ATT_BS11_RADIO_MEAS_REP	= 0xdd,
++
++	NM_ATT_BS11_SH_LAPD_INT_TIMER	= 0xe8,
++
++	NM_ATT_BS11_BTS_STATE		= 0xf0,
++	NM_ATT_BS11_E1_STATE		= 0xf1,
++	NM_ATT_BS11_PLL			= 0xf2,
++	NM_ATT_BS11_RX_OFFSET		= 0xf3,
++	NM_ATT_BS11_ANT_TYPE		= 0xf4,
++	NM_ATT_BS11_PLL_MODE		= 0xfc,
++	NM_ATT_BS11_PASSWORD		= 0xfd,
++};
++#define NM_ATT_BS11_FILE_DATA	NM_ATT_EVENT_TYPE
++
++/* Section 9.4.4: Administrative State */
++enum abis_nm_adm_state {
++	NM_STATE_LOCKED		= 0x01,
++	NM_STATE_UNLOCKED	= 0x02,
++	NM_STATE_SHUTDOWN	= 0x03,
++	NM_STATE_NULL		= 0xff,
++};
++
++/* Section 9.4.13: Channel Combination */
++enum abis_nm_chan_comb {
++	NM_CHANC_TCHFull	= 0x00,
++	NM_CHANC_TCHHalf	= 0x01,
++	NM_CHANC_TCHHalf2	= 0x02,
++	NM_CHANC_SDCCH		= 0x03,
++	NM_CHANC_mainBCCH	= 0x04,
++	NM_CHANC_BCCHComb	= 0x05,
++	NM_CHANC_BCCH		= 0x06,
++	NM_CHANC_BCCH_CBCH	= 0x07,
++	NM_CHANC_SDCCH_CBCH	= 0x08,
++};
++
++/* Section 9.4.16: Event Type */
++enum abis_nm_event_type {
++	NM_EVT_COMM_FAIL	= 0x00,
++	NM_EVT_QOS_FAIL		= 0x01,
++	NM_EVT_PROC_FAIL	= 0x02,
++	NM_EVT_EQUIP_FAIL	= 0x03,
++	NM_EVT_ENV_FAIL		= 0x04,
++};
++
++/* Section: 9.4.63: Perceived Severity */
++enum abis_nm_severity {
++	NM_SEVER_CEASED		= 0x00,
++	NM_SEVER_CRITICAL	= 0x01,
++	NM_SEVER_MAJOR		= 0x02,
++	NM_SEVER_MINOR		= 0x03,
++	NM_SEVER_WARNING	= 0x04,
++	NM_SEVER_INDETERMINATE	= 0x05,
++};
++
++/* Section 9.4.43: Probable Cause Type */
++enum abis_nm_pcause_type {
++	NM_PCAUSE_T_X721	= 0x01,
++	NM_PCAUSE_T_GSM		= 0x02,
++	NM_PCAUSE_T_MANUF	= 0x03,
++};
++
++/* Section 9.4.36: NACK Causes */
++enum abis_nm_nack_cause {
++	/* General Nack Causes */
++	NM_NACK_INCORR_STRUCT		= 0x01,
++	NM_NACK_MSGTYPE_INVAL		= 0x02,
++	NM_NACK_OBJCLASS_INVAL		= 0x05,
++	NM_NACK_OBJCLASS_NOTSUPP	= 0x06,
++	NM_NACK_BTSNR_UNKN		= 0x07,
++	NM_NACK_TRXNR_UNKN		= 0x08,
++	NM_NACK_OBJINST_UNKN		= 0x09,
++	NM_NACK_ATTRID_INVAL		= 0x0c,
++	NM_NACK_ATTRID_NOTSUPP		= 0x0d,
++	NM_NACK_PARAM_RANGE		= 0x0e,
++	NM_NACK_ATTRLIST_INCONSISTENT	= 0x0f,
++	NM_NACK_SPEC_IMPL_NOTSUPP	= 0x10,
++	NM_NACK_CANT_PERFORM		= 0x11,
++	/* Specific Nack Causes */
++	NM_NACK_RES_NOTIMPL		= 0x19,
++	NM_NACK_RES_NOTAVAIL		= 0x1a,
++	NM_NACK_FREQ_NOTAVAIL		= 0x1b,
++	NM_NACK_TEST_NOTSUPP		= 0x1c,
++	NM_NACK_CAPACITY_RESTR		= 0x1d,
++	NM_NACK_PHYSCFG_NOTPERFORM	= 0x1e,
++	NM_NACK_TEST_NOTINIT		= 0x1f,
++	NM_NACK_PHYSCFG_NOTRESTORE	= 0x20,
++	NM_NACK_TEST_NOSUCH		= 0x21,
++	NM_NACK_TEST_NOSTOP		= 0x22,
++	NM_NACK_MSGINCONSIST_PHYSCFG	= 0x23,
++	NM_NACK_FILE_INCOMPLETE		= 0x25,
++	NM_NACK_FILE_NOTAVAIL		= 0x26,
++	NM_NACK_FILE_NOTACTIVATE	= 0x27,
++	NM_NACK_REQ_NOT_GRANT		= 0x28,
++	NM_NACK_WAIT			= 0x29,
++	NM_NACK_NOTH_REPORT_EXIST	= 0x2a,
++	NM_NACK_MEAS_NOTSUPP		= 0x2b,
++	NM_NACK_MEAS_NOTSTART		= 0x2c,
++};
++
++/* Section 9.4.1 */
++struct abis_nm_channel {
++	guint8	attrib;
++	guint8	bts_port;
++	guint8	timeslot;
++	guint8	subslot;
++} __attribute__ ((packed));
++
++/* Siemens BS-11 specific objects in the SienemsHW (0xA5) object class */
++enum abis_bs11_objtype {
++	BS11_OBJ_ALCO		= 0x01,
++	BS11_OBJ_BBSIG		= 0x02,	/* obj_class: 0,1 */
++	BS11_OBJ_TRX1		= 0x03,	/* only DEACTIVATE TRX1 */
++	BS11_OBJ_CCLK		= 0x04,
++	BS11_OBJ_GPSU		= 0x06,
++	BS11_OBJ_LI		= 0x07,
++	BS11_OBJ_PA		= 0x09,	/* obj_class: 0, 1*/
++};
++
++enum abis_bs11_trx_power {
++	BS11_TRX_POWER_GSM_2W	= 0x06,
++	BS11_TRX_POWER_GSM_250mW= 0x07,
++	BS11_TRX_POWER_GSM_80mW	= 0x08,
++	BS11_TRX_POWER_GSM_30mW	= 0x09,
++	BS11_TRX_POWER_DCS_3W	= 0x0a,
++	BS11_TRX_POWER_DCS_1W6	= 0x0b,
++	BS11_TRX_POWER_DCS_500mW= 0x0c,
++	BS11_TRX_POWER_DCS_160mW= 0x0d,
++};
++
++enum abis_bs11_li_pll_mode {
++	BS11_LI_PLL_LOCKED	= 2,
++	BS11_LI_PLL_STANDALONE	= 3,
++};
++
++enum abis_bs11_phase {
++	BS11_STATE_SOFTWARE_RQD		= 0x01,
++	BS11_STATE_LOAD_SMU_INTENDED	= 0x11,
++	BS11_STATE_LOAD_SMU_SAFETY	= 0x21,
++	BS11_STATE_LOAD_FAILED		= 0x31,
++	BS11_STATE_LOAD_DIAGNOSTIC	= 0x41,
++	BS11_STATE_WARM_UP		= 0x51,
++	BS11_STATE_WARM_UP_2		= 0x52,
++	BS11_STATE_WAIT_MIN_CFG		= 0x62,
++	BS11_STATE_MAINTENANCE		= 0x72,
++	BS11_STATE_LOAD_MBCCU		= 0x92,
++	BS11_STATE_WAIT_MIN_CFG_2	= 0xA2,
++	BS11_STATE_NORMAL		= 0x03,
++	BS11_STATE_ABIS_LOAD		= 0x13,
++};
++
++/* From openbsc/include/openbsc/tlv.h */
++enum tlv_type {
++	TLV_TYPE_FIXED,
++	TLV_TYPE_T,
++	TLV_TYPE_TV,
++	TLV_TYPE_TLV,
++	TLV_TYPE_TL16V,
++};
++
++struct tlv_def {
++	enum tlv_type type;
++	u_int8_t fixed_len;
++};
++
++struct tlv_definition {
++	struct tlv_def def[0xff];
++};
++
++
++/* From openbsc/src/abis_nm.c */
++static const struct tlv_definition nm_att_tlvdef = {
++	.def = {
++		[NM_ATT_ABIS_CHANNEL] =		{ TLV_TYPE_FIXED, 3 },
++		[NM_ATT_ADD_INFO] =		{ TLV_TYPE_TL16V, 0 },
++		[NM_ATT_ADD_TEXT] =		{ TLV_TYPE_TL16V },
++		[NM_ATT_ADM_STATE] =		{ TLV_TYPE_TV },
++		[NM_ATT_ARFCN_LIST]=		{ TLV_TYPE_TL16V },
++		[NM_ATT_AUTON_REPORT] =		{ TLV_TYPE_TV },
++		[NM_ATT_AVAIL_STATUS] =		{ TLV_TYPE_TL16V },
++		[NM_ATT_BCCH_ARFCN] =		{ TLV_TYPE_FIXED, 2 },
++		[NM_ATT_BSIC] =			{ TLV_TYPE_TV },
++		[NM_ATT_BTS_AIR_TIMER] =	{ TLV_TYPE_TV },
++		[NM_ATT_CCCH_L_I_P] =		{ TLV_TYPE_TV },
++		[NM_ATT_CCCH_L_T] =		{ TLV_TYPE_TV },
++		[NM_ATT_CHAN_COMB] =		{ TLV_TYPE_TV },
++		[NM_ATT_CONN_FAIL_CRIT] =	{ TLV_TYPE_TL16V },
++		[NM_ATT_DEST] =			{ TLV_TYPE_TL16V },
++		[NM_ATT_EVENT_TYPE] =		{ TLV_TYPE_TV },
++		[NM_ATT_FILE_DATA] =		{ TLV_TYPE_TL16V },
++		[NM_ATT_FILE_ID] =		{ TLV_TYPE_TL16V },
++		[NM_ATT_FILE_VERSION] =		{ TLV_TYPE_TL16V },
++		[NM_ATT_GSM_TIME] =		{ TLV_TYPE_FIXED, 2 },
++		[NM_ATT_HSN] =			{ TLV_TYPE_TV },
++		[NM_ATT_HW_CONFIG] =		{ TLV_TYPE_TL16V },
++		[NM_ATT_HW_DESC] =		{ TLV_TYPE_TL16V },
++		[NM_ATT_INTAVE_PARAM] =		{ TLV_TYPE_TV },
++		[NM_ATT_INTERF_BOUND] =		{ TLV_TYPE_FIXED, 6 },
++		[NM_ATT_LIST_REQ_ATTR] =	{ TLV_TYPE_TL16V },
++		[NM_ATT_MAIO] =			{ TLV_TYPE_TV },
++		[NM_ATT_MANUF_STATE] =		{ TLV_TYPE_TV },
++		[NM_ATT_MANUF_THRESH] =		{ TLV_TYPE_TL16V },
++		[NM_ATT_MANUF_ID] =		{ TLV_TYPE_TL16V },
++		[NM_ATT_MAX_TA] =		{ TLV_TYPE_TV },
++		[NM_ATT_MDROP_LINK] =		{ TLV_TYPE_FIXED, 2 },
++		[NM_ATT_MDROP_NEXT] =		{ TLV_TYPE_FIXED, 2 },
++		[NM_ATT_NACK_CAUSES] =		{ TLV_TYPE_TV },
++		[NM_ATT_NY1] =			{ TLV_TYPE_TV },
++		[NM_ATT_OPER_STATE] =		{ TLV_TYPE_TV },
++		[NM_ATT_OVERL_PERIOD] =		{ TLV_TYPE_TL16V },
++		[NM_ATT_PHYS_CONF] =		{ TLV_TYPE_TL16V },
++		[NM_ATT_POWER_CLASS] =		{ TLV_TYPE_TV },
++		[NM_ATT_POWER_THRESH] =		{ TLV_TYPE_FIXED, 3 },
++		[NM_ATT_PROB_CAUSE] =		{ TLV_TYPE_FIXED, 3 },
++		[NM_ATT_RACH_B_THRESH] =	{ TLV_TYPE_TV },
++		[NM_ATT_LDAVG_SLOTS] =		{ TLV_TYPE_FIXED, 2 },
++		[NM_ATT_RAD_SUBC] =		{ TLV_TYPE_TV },
++		[NM_ATT_RF_MAXPOWR_R] =		{ TLV_TYPE_TV },
++		[NM_ATT_SITE_INPUTS] =		{ TLV_TYPE_TL16V },
++		[NM_ATT_SITE_OUTPUTS] =		{ TLV_TYPE_TL16V },
++		[NM_ATT_SOURCE] =		{ TLV_TYPE_TL16V },
++		[NM_ATT_SPEC_PROB] =		{ TLV_TYPE_TV },
++		[NM_ATT_START_TIME] =		{ TLV_TYPE_FIXED, 2 },
++		[NM_ATT_T200] =			{ TLV_TYPE_FIXED, 7 },
++		[NM_ATT_TEI] =			{ TLV_TYPE_TV },
++		[NM_ATT_TEST_DUR] =		{ TLV_TYPE_FIXED, 2 },
++		[NM_ATT_TEST_NO] =		{ TLV_TYPE_TV },
++		[NM_ATT_TEST_REPORT] =		{ TLV_TYPE_TL16V, },
++		[NM_ATT_VSWR_THRESH] =		{ TLV_TYPE_FIXED, 2 },
++		[NM_ATT_WINDOW_SIZE] = 		{ TLV_TYPE_TV },
++		[NM_ATT_TSC] =			{ TLV_TYPE_TV },
++		[NM_ATT_SW_CONFIG] =		{ TLV_TYPE_TL16V },
++		[NM_ATT_SEVERITY] = 		{ TLV_TYPE_TV },
++		[NM_ATT_GET_ARI] =		{ TLV_TYPE_TL16V },
++		[NM_ATT_HW_CONF_CHG] = 		{ TLV_TYPE_TL16V },
++		[NM_ATT_OUTST_ALARM] =		{ TLV_TYPE_TV },
++		[NM_ATT_FILE_DATA] =		{ TLV_TYPE_TL16V },
++		[NM_ATT_MEAS_RES] =		{ TLV_TYPE_TL16V },
++		/* BS11 specifics */
++		[NM_ATT_BS11_ESN_FW_CODE_NO] =	{ TLV_TYPE_TLV },
++		[NM_ATT_BS11_ESN_HW_CODE_NO] =	{ TLV_TYPE_TLV },
++		[NM_ATT_BS11_ESN_PCB_SERIAL] =	{ TLV_TYPE_TLV },
++		[NM_ATT_BS11_BOOT_SW_VERS] =	{ TLV_TYPE_TLV },
++		[0xd5] =			{ TLV_TYPE_TLV },
++		[0xa8] =			{ TLV_TYPE_TLV },
++		[NM_ATT_BS11_PASSWORD] =	{ TLV_TYPE_TLV },
++		[NM_ATT_BS11_TXPWR] =		{ TLV_TYPE_TLV },
++		[NM_ATT_BS11_RSSI_OFFS] =	{ TLV_TYPE_TLV },
++		[NM_ATT_BS11_LINE_CFG] = 	{ TLV_TYPE_TV },
++		[NM_ATT_BS11_L1_PROT_TYPE] =	{ TLV_TYPE_TV },
++		[NM_ATT_BS11_BIT_ERR_THESH] =	{ TLV_TYPE_FIXED, 2 },
++		[NM_ATT_BS11_DIVERSITY] =	{ TLV_TYPE_TLV },
++		[NM_ATT_BS11_LMT_LOGON_SESSION]={ TLV_TYPE_TLV },
++		[NM_ATT_BS11_LMT_LOGIN_TIME] =	{ TLV_TYPE_TLV },
++		[NM_ATT_BS11_LMT_USER_ACC_LEV] ={ TLV_TYPE_TLV },
++		[NM_ATT_BS11_LMT_USER_NAME] =	{ TLV_TYPE_TLV },
++		[NM_ATT_BS11_BTS_STATE]	=	{ TLV_TYPE_TLV },
++		[NM_ATT_BS11_E1_STATE]	=	{ TLV_TYPE_TLV },
++		[NM_ATT_BS11_PLL_MODE]	=	{ TLV_TYPE_TLV },
++		[NM_ATT_BS11_PLL]	=	{ TLV_TYPE_TLV },
++		[NM_ATT_BS11_CCLK_ACCURACY] =	{ TLV_TYPE_TV },
++		[NM_ATT_BS11_CCLK_TYPE] =	{ TLV_TYPE_TV },
++		/* ip.access specifics */
++		[NM_ATT_IPACC_RSL_BSC_IP] =	{ TLV_TYPE_FIXED, 4 },
++		[NM_ATT_IPACC_RSL_BSC_PORT] =	{ TLV_TYPE_FIXED, 2 },
++		[NM_ATT_IPACC_PRIM_OML_IP] =	{ TLV_TYPE_FIXED, 6 },
++		[0x95] =			{ TLV_TYPE_FIXED, 2 },
++		[0x85] =			{ TLV_TYPE_TV },
++
++	},
++};
++
++#endif /* _NM_H */
diff --git a/wireshark/abisip.patch b/wireshark/abisip.patch
index 9802595..97f203a 100644
--- a/wireshark/abisip.patch
+++ b/wireshark/abisip.patch
@@ -1,7 +1,7 @@
 Index: epan/dissectors/Makefile.common
 ===================================================================
---- epan/dissectors/Makefile.common.orig
-+++ epan/dissectors/Makefile.common
+--- epan/dissectors/Makefile.common.orig	2009-02-28 15:39:56.000000000 +0100
++++ epan/dissectors/Makefile.common	2009-06-25 15:04:16.000000000 +0200
 @@ -873,6 +873,7 @@
  # Dissectors with warnings.
  #
@@ -12,8 +12,8 @@
  	packet-sccp.c		\
 Index: epan/dissectors/packet-rsl.c
 ===================================================================
---- epan/dissectors/packet-rsl.c.orig
-+++ epan/dissectors/packet-rsl.c
+--- epan/dissectors/packet-rsl.c.orig	2009-02-28 15:39:51.000000000 +0100
++++ epan/dissectors/packet-rsl.c	2009-02-28 15:39:56.000000000 +0100
 @@ -3950,6 +3950,7 @@
  	proto_register_field_array(proto_rsl, hf, array_length(hf));
  	proto_register_subtree_array(ett, array_length(ett));
@@ -24,9 +24,9 @@
  
 Index: epan/dissectors/packet-abis_ip.c
 ===================================================================
---- /dev/null
-+++ epan/dissectors/packet-abis_ip.c
-@@ -0,0 +1,275 @@
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ epan/dissectors/packet-abis_ip.c	2009-06-25 15:04:42.000000000 +0200
+@@ -0,0 +1,279 @@
 +/* packet-abis_ip.c
 + * Routines for packet dissection of ip.access A-bis over IP
 + * Copyright 2009 by Harald Welte <laforge@gnumonks.org>
@@ -209,8 +209,11 @@
 +						   "unknown 0x%02x"));
 +
 +		if (tree) {
-+			ti = proto_tree_add_item(tree, proto_abisip, tvb,
-+						 offset, len+3, FALSE);
++			ti = proto_tree_add_protocol_format(tree, proto_abisip,
++					tvb, offset, len+3,
++					"A-bis/IP protocol ip.access, type: %s",
++					val_to_str(msg_type, abisip_protocol_vals,
++						   "unknown 0x%02x"));
 +			abisip_tree = proto_item_add_subtree(ti, ett_abisip);
 +			proto_tree_add_item(abisip_tree, hf_abisip_data_len,
 +					    tvb, offset+1, 1, FALSE);
@@ -227,10 +230,9 @@
 +			break;
 +		case ABISIP_OML:
 +			/* hand this off to the standard A-bis OML dissector */
-+#if 0
-+			call_dissector(sub_handles[SUB_OML], next_tvb,
-+					 pinfo, tree);
-+#endif
++			if (sub_handles[SUB_OML])
++				call_dissector(sub_handles[SUB_OML], next_tvb,
++						 pinfo, tree);
 +			break;
 +		case ABISIP_IPACCESS:
 +			dissect_ipaccess(next_tvb, pinfo, tree);
@@ -287,6 +289,8 @@
 +	proto_register_field_array(proto_abisip, hf, array_length(hf));
 +	proto_register_field_array(proto_ipaccess, hf_ipa, array_length(hf_ipa));
 +	proto_register_subtree_array(ett, array_length(ett));
++
++	register_dissector("gsm_abis_ip", dissect_abisip, proto_abisip);
 +}
 +
 +void proto_reg_handoff_abisip(void)