diff --git a/include/openbsc/db.h b/include/openbsc/db.h
index 9ce7181..61a3ac4 100644
--- a/include/openbsc/db.h
+++ b/include/openbsc/db.h
@@ -37,4 +37,8 @@
 int db_subscriber_alloc_tmsi(struct gsm_subscriber* subscriber);
 int db_subscriber_assoc_imei(struct gsm_subscriber* subscriber, char *imei);
 
+/* SMS store-and-forward */
+int db_sms_store(struct gsm_sms *sms);
+struct gsm_sms *db_sms_get_unsent(int min_id);
+int db_sms_mark_sent(struct gsm_sms *sms);
 #endif /* _DB_H */
diff --git a/include/openbsc/gsm_04_11.h b/include/openbsc/gsm_04_11.h
index 71f6c0c..12c607f 100644
--- a/include/openbsc/gsm_04_11.h
+++ b/include/openbsc/gsm_04_11.h
@@ -38,24 +38,110 @@
 	u_int8_t data[0];
 } __attribute__ ((packed));
 
+/* our own enum, not related to on-air protocol */
+enum sms_alphabet {
+	DCS_NONE,
+	DCS_7BIT_DEFAULT,
+	DCS_UCS2,
+	DCS_8BIT_DATA,
+};
+
 /* SMS submit PDU */
 struct sms_submit {
 	u_int8_t *smsc;
 	u_int8_t mti:2;
-	u_int8_t mms:1;
 	u_int8_t vpf:2;
+	u_int8_t msg_ref;
+	u_int8_t pid;
+	u_int8_t dcs;
+	u_int8_t *vp;
+	u_int8_t ud_len;
+	u_int8_t *user_data;
+
+	/* interpreted */
+	u_int8_t mms:1;
 	u_int8_t sri:1;
 	u_int8_t udhi:1;
 	u_int8_t rp:1;
-	u_int8_t msg_ref;
-	u_int8_t *dest_addr;
-	u_int8_t pid;
-	u_int8_t dcs;
-	u_int8_t vp;
-	u_int8_t ud_len;
-	u_int8_t *user_data;
+	enum sms_alphabet alphabet;
+	char dest_addr[20+1];	/* DA LV is 12 bytes max, i.e. 10 bytes BCD == 20 bytes string */
+	unsigned long validity_mins;
+	char decoded[256];
 };
 
+/* GSM 03.40 / Chapter 9.2.3.1: TP-Message-Type-Indicator */
+#define GSM340_SMS_DELIVER_SC2MS	0x00
+#define GSM340_SMS_DELIVER_REP_MS2SC	0x00
+#define GSM340_SMS_STATUS_REP_SC2MS	0x02
+#define GSM340_SMS_COMMAND_MS2SC	0x02
+#define GSM340_SMS_SUBMIT_MS2SC		0x01
+#define GSM340_SMS_SUBMIT_REP_SC2MS	0x01
+#define GSM340_SMS_RESSERVED		0x03
+
+/* GSM 03.40 / Chapter 9.2.3.2: TP-More-Messages-to-Send */
+#define GSM340_TP_MMS_MORE		0
+#define GSM340_TP_MMS_NO_MORE		1
+
+/* GSM 03.40 / Chapter 9.2.3.3: TP-Validity-Period-Format */
+#define GSM340_TP_VPF_NONE		0
+#define GSM340_TP_VPF_RELATIVE		2
+#define GSM340_TP_VPF_ENHANCED		1
+#define GSM340_TP_VPF_ABSOLUTE		3
+
+/* GSM 03.40 / Chapter 9.2.3.4: TP-Status-Report-Indication */
+#define GSM340_TP_SRI_NONE		0
+#define GSM340_TP_SRI_PRESENT		1
+
+/* GSM 03.40 / Chapter 9.2.3.5: TP-Status-Report-Request */
+#define GSM340_TP_SRR_NONE		0
+#define GSM340_TP_SRR_REQUESTED		1
+
+/* GSM 03.40 / Chapter 9.2.3.9: TP-Protocol-Identifier */
+/* telematic interworking (001 or 111 in bits 7-5) */
+#define GSM340_TP_PID_IMPLICIT		0x00
+#define GSM340_TP_PID_TELEX		0x01
+#define GSM340_TP_PID_FAX_G3		0x02
+#define GSM340_TP_PID_FAX_G4		0x03
+#define GSM340_TP_PID_VOICE		0x04
+#define GSM430_TP_PID_ERMES		0x05
+#define GSM430_TP_PID_NATIONAL_PAGING	0x06
+#define GSM430_TP_PID_VIDEOTEX		0x07
+#define GSM430_TP_PID_TELETEX_UNSPEC	0x08
+#define GSM430_TP_PID_TELETEX_PSPDN	0x09
+#define GSM430_TP_PID_TELETEX_CSPDN	0x0a
+#define GSM430_TP_PID_TELETEX_PSTN	0x0b
+#define GSM430_TP_PID_TELETEX_ISDN	0x0c
+#define GSM430_TP_PID_TELETEX_UCI	0x0d
+#define GSM430_TP_PID_MSG_HANDLING	0x10
+#define GSM430_TP_PID_MSG_X400		0x11
+#define GSM430_TP_PID_EMAIL		0x12
+#define GSM430_TP_PID_GSM_MS		0x1f
+/* if bit 7 = 0 and bit 6 = 1 */
+#define GSM430_TP_PID_SMS_TYPE_0	0
+#define GSM430_TP_PID_SMS_TYPE_1	1
+#define GSM430_TP_PID_SMS_TYPE_2	2
+#define GSM430_TP_PID_SMS_TYPE_3	3
+#define GSM430_TP_PID_SMS_TYPE_4	4
+#define GSM430_TP_PID_SMS_TYPE_5	5
+#define GSM430_TP_PID_SMS_TYPE_6	6
+#define GSM430_TP_PID_SMS_TYPE_7	7
+#define GSM430_TP_PID_RETURN_CALL_MSG	0x1f
+#define GSM430_TP_PID_ME_DATA_DNLOAD	0x3d
+#define GSM430_TP_PID_ME_DE_PERSONAL	0x3e
+#define GSM430_TP_PID_ME_SIM_DNLOAD	0x3f
+
+/* GSM 03.38 Chapter 4: SMS Data Coding Scheme */
+#define GSM338_DCS_00_
+
+#define GSM338_DCS_1110_7BIT		(0 << 2)
+#define GSM338_DCS_1111_7BIT		(0 << 2)
+#define GSM338_DCS_1111_8BIT_DATA	(1 << 2)
+#define GSM338_DCS_1111_CLASS0		0
+#define GSM338_DCS_1111_CLASS1_ME	1
+#define GSM338_DCS_1111_CLASS2_SIM	2
+#define GSM338_DCS_1111_CLASS3_TE	3	/* See TS 07.05 */
+
+
 /* SMS deliver PDU */
 struct sms_deliver {
 	u_int8_t *smsc;
diff --git a/include/openbsc/gsm_data.h b/include/openbsc/gsm_data.h
index 84d33d2..614c63d 100644
--- a/include/openbsc/gsm_data.h
+++ b/include/openbsc/gsm_data.h
@@ -317,6 +317,17 @@
 	struct gsm_bts	bts[GSM_MAX_BTS+1];
 };
 
+#define SMS_HDR_SIZE	128
+#define SMS_TEXT_SIZE	256
+struct gsm_sms {
+	u_int64_t id;
+	struct gsm_subscriber *sender;
+	struct gsm_subscriber *receiver;
+
+	unsigned char header[SMS_HDR_SIZE];
+	char text[SMS_TEXT_SIZE];
+};
+
 struct gsm_network *gsm_network_init(unsigned int num_bts, enum gsm_bts_type bts_type,
 				     u_int16_t country_code, u_int16_t network_code);
 
diff --git a/include/openbsc/gsm_utils.h b/include/openbsc/gsm_utils.h
index b5637c8..c468371 100644
--- a/include/openbsc/gsm_utils.h
+++ b/include/openbsc/gsm_utils.h
@@ -2,6 +2,7 @@
 /*
  * (C) 2008 by Daniel Willmann <daniel@totalueberwachung.de>
  * (C) 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2009 by Harald Welte <laforge@gnumonks.org>
  *
  * All Rights Reserved
  *
@@ -26,7 +27,7 @@
 
 #include <sys/types.h>
 
-char *gsm_7bit_decode(u_int8_t *user_data, u_int8_t length);
-u_int8_t *gsm_7bit_encode(const char *data, u_int8_t *length);
+int gsm_7bit_decode(char *decoded, const u_int8_t *user_data, u_int8_t length);
+int gsm_7bit_encode(u_int8_t *result, const char *data);
 
 #endif
diff --git a/src/db.c b/src/db.c
index a7c4f3d..17ea17d 100644
--- a/src/db.c
+++ b/src/db.c
@@ -19,18 +19,67 @@
  *
  */
 
+#include <openbsc/gsm_data.h>
 #include <openbsc/db.h>
 
 #include <libgen.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <errno.h>
 #include <dbi/dbi.h>
 
 static char *db_basename = NULL;
 static char *db_dirname = NULL;
 dbi_conn conn;
 
+static char *create_stmts[] = {
+	"CREATE TABLE IF NOT EXISTS Meta ("
+		"id INTEGER PRIMARY KEY AUTOINCREMENT, "
+		"key TEXT UNIQUE NOT NULL, "
+		"value TEXT NOT NULL"
+		")",
+	"INSERT OR IGNORE INTO Meta "
+		"(key, value) "
+		"VALUES "
+		"('revision', '1')",
+	"CREATE TABLE IF NOT EXISTS Subscriber ("
+		"id INTEGER PRIMARY KEY AUTOINCREMENT, "
+		"created TIMESTAMP NOT NULL, "
+		"updated TIMESTAMP NOT NULL, "
+		"imsi NUMERIC UNIQUE NOT NULL, "
+		"name TEXT, "
+		"extension TEXT UNIQUE, "
+		"authorized INTEGER NOT NULL DEFAULT 0, "
+		"tmsi TEXT UNIQUE, "
+		"lac INTEGER NOT NULL DEFAULT 0"
+		")",
+	"CREATE TABLE IF NOT EXISTS Equipment ("
+		"id INTEGER PRIMARY KEY AUTOINCREMENT, "
+		"created TIMESTAMP NOT NULL, "
+		"updated TIMESTAMP NOT NULL, "
+		"name TEXT, "
+		"imei NUMERIC UNIQUE NOT NULL"
+		")",
+	"CREATE TABLE IF NOT EXISTS EquipmentWatch ("
+		"id INTEGER PRIMARY KEY AUTOINCREMENT, "
+		"created TIMESTAMP NOT NULL, "
+		"updated TIMESTAMP NOT NULL, "
+		"subscriber_id NUMERIC NOT NULL, "
+		"equipment_id NUMERIC NOT NULL, "
+		"UNIQUE (subscriber_id, equipment_id) "
+		")",
+	"CREATE TABLE IF NOT EXISTS SMS ("
+		"id INTEGER PRIMARY KEY AUTOINCREMENT, "
+		"created TIMESTAMP NOT NULL, "
+		"sent TIMESTAMP, "
+		"sender_id NUMERIC NOT NULL, "
+		"receiver_id NUMERIC NOT NULL, "
+		"header NUMERIC, "
+		"text TEXT NOT NULL "
+		")",
+};
+
 void db_error_func(dbi_conn conn, void* data) {
 	const char* msg;
 	dbi_conn_error(conn, &msg);
@@ -73,93 +122,16 @@
 
 int db_prepare() {
 	dbi_result result;
-	result = dbi_conn_query(conn,
-		"CREATE TABLE IF NOT EXISTS Meta ("
-		"id INTEGER PRIMARY KEY AUTOINCREMENT, "
-		"key TEXT UNIQUE NOT NULL, "
-		"value TEXT NOT NULL"
-		")"
-	);
-	if (result==NULL) {
-		printf("DB: Failed to create Meta table.\n");
-		return 1;
-	}
-	dbi_result_free(result);
-	result = dbi_conn_query(conn,
-		"INSERT OR IGNORE INTO Meta "
-		"(key, value) "
-		"VALUES "
-		"('revision', '1')"
-	);
-	if (result==NULL) {
-		printf("DB: Failed to create Meta table.\n");
-		return 1;
-	}
-	dbi_result_free(result);
-	result = dbi_conn_query(conn,
-		"CREATE TABLE IF NOT EXISTS Subscriber ("
-		"id INTEGER PRIMARY KEY AUTOINCREMENT, "
-		"created TIMESTAMP NOT NULL, "
-		"updated TIMESTAMP NOT NULL, "
-		"imsi NUMERIC UNIQUE NOT NULL, "
-		"name TEXT, "
-		"extension TEXT UNIQUE, "
-		"authorized INTEGER NOT NULL DEFAULT 0, "
-		"tmsi TEXT UNIQUE, "
-		"lac INTEGER NOT NULL DEFAULT 0"
-		")"
-	);
-	if (result==NULL) {
-		printf("DB: Failed to create Subscriber table.\n");
-		return 1;
-	}
-	dbi_result_free(result);
-	result = dbi_conn_query(conn,
-		"CREATE TABLE IF NOT EXISTS Equipment ("
-		"id INTEGER PRIMARY KEY AUTOINCREMENT, "
-		"created TIMESTAMP NOT NULL, "
-		"updated TIMESTAMP NOT NULL, "
-		"name TEXT, "
-		"imei NUMERIC UNIQUE NOT NULL"
-		")"
-	);
-	if (result==NULL) {
-		printf("DB: Failed to create Equipment table.\n");
-		return 1;
-	}
-	dbi_result_free(result);
-	result = dbi_conn_query(conn,
-		"CREATE TABLE IF NOT EXISTS EquipmentWatch ("
-		"id INTEGER PRIMARY KEY AUTOINCREMENT, "
-		"created TIMESTAMP NOT NULL, "
-		"updated TIMESTAMP NOT NULL, "
-		"subscriber_id NUMERIC NOT NULL, "
-		"equipment_id NUMERIC NOT NULL, "
-		"UNIQUE (subscriber_id, equipment_id) "
-		")"
-	);
-	if (result==NULL) {
-		printf("DB: Failed to create Equipment table.\n");
-		return 1;
-	}
-	dbi_result_free(result);
+	int i;
 
-	result = dbi_conn_query(conn,
-		"CREATE TABLE IF NOT EXISTS SMS ("
-		"id INTEGER PRIMARY KEY AUTOINCREMENT, "
-		"created TIMESTAMP NOT NULL, "
-		"sent TIMESTAMP, "
-		"sender_id NUMERIC NOT NULL, "
-		"receiver_id NUMERIC NOT NULL, "
-		"header NUMERIC, "
-		"text TEXT NOT NULL "
-		")"
-	);
-	if (result==NULL) {
-		printf("DB: Failed to create Equipment table.\n");
-		return 1;
+	for (i = 0; i < ARRAY_SIZE(create_stmts); i++) {
+		result = dbi_conn_query(conn, create_stmts[i]);
+		if (result==NULL) {
+			printf("DB: Failed to create some table.\n");
+			return 1;
+		}
+		dbi_result_free(result);
 	}
-	dbi_result_free(result);
 
 	return 0;
 }
@@ -419,3 +391,68 @@
 	return 0;
 }
 
+/* store an [unsent] SMS to the database */
+int db_sms_store(struct gsm_sms *sms)
+{
+	dbi_result result;
+	char *q_text;
+
+	dbi_conn_quote_string_copy(conn, (char *)sms->text, &q_text);
+	result = dbi_conn_queryf(conn,
+		"INSERT INTO SMS "
+		"(created,sender_id,receiver_id,header,text) VALUES "
+		"(datetime('now'),%llu,%llu,%s,%s)",
+		sms->sender->id,
+		sms->receiver ? sms->receiver->id : 0,
+		NULL, q_text);
+	free(q_text);
+
+	if (!result)
+		return -EIO;
+
+	dbi_result_free(result);
+	return 0;
+}
+
+/* retrieve the next unsent SMS with ID >= min_id */
+struct gsm_sms *db_sms_get_unsent(int min_id)
+{
+	dbi_result result;
+	struct gsm_sms *sms = malloc(sizeof(*sms));
+
+	if (!sms) {
+		free(sms);
+		return NULL;
+	}
+
+	result = dbi_conn_queryf(conn,
+		"SELECT * FROM SMS "
+		"WHERE id >= %llu ORDER BY id", min_id);
+	if (!result) {
+		free(sms);
+		return NULL;
+	}
+
+	/* FIXME: fill gsm_sms from database */
+
+	dbi_result_free(result);
+	return sms;
+}
+
+/* mark a given SMS as read */
+int db_sms_mark_sent(struct gsm_sms *sms)
+{
+	dbi_result result;
+
+	result = dbi_conn_queryf(conn,
+		"UPDATE SMS "
+		"SET sent = datetime('now') "
+		"WHERE id = %llu", sms->id);
+	if (!result) {
+		printf("DB: Failed to mark SMS %llu as sent.\n", sms->id);
+		return 1;
+	}
+
+	dbi_result_free(result);
+	return 0;
+}
diff --git a/src/gsm_04_11.c b/src/gsm_04_11.c
index 35fc12e..c299538 100644
--- a/src/gsm_04_11.c
+++ b/src/gsm_04_11.c
@@ -3,6 +3,7 @@
  * 3GPP TS 04.11 version 7.1.0 Release 1998 / ETSI TS 100 942 V7.1.0 */
 
 /* (C) 2008 by Daniel Willmann <daniel@totalueberwachung.de>
+ * (C) 2009 by Harald Welte <laforge@gnumonks.org>
  *
  * All Rights Reserved
  *
@@ -30,6 +31,7 @@
 #include <netinet/in.h>
 
 #include <openbsc/msgb.h>
+#include <openbsc/tlv.h>
 #include <openbsc/debug.h>
 #include <openbsc/gsm_data.h>
 #include <openbsc/gsm_subscriber.h>
@@ -38,6 +40,7 @@
 #include <openbsc/gsm_utils.h>
 #include <openbsc/abis_rsl.h>
 #include <openbsc/signal.h>
+#include <openbsc/db.h>
 
 #define GSM411_ALLOC_SIZE	1024
 #define GSM411_ALLOC_HEADROOM	128
@@ -64,12 +67,108 @@
 }
 #endif
 
-static int gsm411_sms_submit_from_msgb(struct msgb *msg)
+static unsigned long gsm340_validity_period(struct sms_submit *sms)
+{
+	u_int8_t vp;
+	unsigned long minutes;
+
+	switch (sms->vpf) {
+	case GSM340_TP_VPF_RELATIVE:
+		/* Chapter 9.2.3.12.1 */
+		vp = *(sms->vp);
+		if (vp <= 143)
+			minutes = vp + 1 * 5;
+		else if (vp <= 167)
+			minutes = 12*60 + (vp-143) * 30;
+		else if (vp <= 196)
+			minutes = vp-166 * 60 * 24;
+		else
+			minutes = vp-192 * 60 * 24 * 7;
+		break;
+	case GSM340_TP_VPF_ABSOLUTE:
+		/* Chapter 9.2.3.12.2 */
+		/* FIXME: like service center time stamp */
+		DEBUGP(DSMS, "VPI absolute not implemented yet\n");
+		break;
+	case GSM340_TP_VPF_ENHANCED:
+		/* Chapter 9.2.3.12.3 */
+		/* FIXME: implementation */
+		DEBUGP(DSMS, "VPI enhanced not implemented yet\n");
+		break;
+	}
+	return minutes;
+}
+
+/* determine coding alphabet dependent on GSM 03.38 Section 4 DCS */
+enum sms_alphabet gsm338_get_sms_alphabet(u_int8_t dcs)
+{
+	u_int8_t cgbits = dcs >> 4;
+	enum sms_alphabet alpha = DCS_NONE;
+
+	if ((cgbits & 0xc) == 0) {
+		if (cgbits & 2)
+			DEBUGP(DSMS, "Compressed SMS not supported yet\n");
+
+		switch (dcs & 3) {
+		case 0:
+			alpha = DCS_7BIT_DEFAULT;
+			break;
+		case 1:
+			alpha = DCS_8BIT_DATA;
+			break;
+		case 2:
+			alpha = DCS_UCS2;
+			break;
+		}
+	} else if (cgbits == 0xc || cgbits == 0xd)
+		alpha = DCS_7BIT_DEFAULT;
+	else if (cgbits == 0xe)
+		alpha = DCS_UCS2;
+	else if (cgbits == 0xf) {
+		if (dcs & 4)
+			alpha = DCS_8BIT_DATA;
+		else
+			alpha = DCS_7BIT_DEFAULT;
+	}
+
+	return alpha;
+}
+
+static int gsm340_rx_sms_submit(struct msgb *msg, struct sms_submit *sms,
+				struct gsm_sms *gsms)
+{
+	if (db_sms_store(gsms) != 0) {
+		DEBUGP(DSMS, "Failed to store SMS in Database\n");
+		free(sms);
+		free(gsms);
+		return -EIO;
+	}
+	return 0;
+}
+
+/* process an incoming TPDU (called from RP-DATA) */
+static int gsm340_rx_tpdu(struct msgb *msg)
 {
 	u_int8_t *smsp = msgb_sms(msg);
 	struct sms_submit *sms;
+	struct gsm_sms *gsms;
+	u_int8_t da_len_bytes;
+	u_int8_t address_lv[12]; /* according to 03.40 / 9.1.2.5 */
+	int rc = 0;
 
 	sms = malloc(sizeof(*sms));
+	if (!sms)
+		return -ENOMEM;
+	memset(sms, 0, sizeof(*sms));
+
+	gsms = malloc(sizeof(*gsms));
+	if (!gsms) {
+		free(sms);
+		return -ENOMEM;
+	}
+	memset(gsms, 0, sizeof(*gsms));
+
+	/* invert those fields where 0 means active/present */
 	sms->mti = *smsp & 0x03;
 	sms->mms = !!(*smsp & 0x04);
 	sms->vpf = (*smsp & 0x18) >> 3;
@@ -80,35 +179,98 @@
 	smsp++;
 	sms->msg_ref = *smsp++;
 
-	/* Skip destination address for now */
-	smsp += 2 + *smsp/2 + *smsp%2;
+	/* length in bytes of the destination address */
+	da_len_bytes = 2 + *smsp/2 + *smsp%2;
+	if (da_len_bytes > 12) {
+		DEBUGP(DSMS, "Destination Address > 12 bytes ?!?\n");
+		rc = -EIO;
+		goto out;
+	}
+	memcpy(address_lv, smsp, da_len_bytes);
+	/* mangle first byte to reflect length in bytes, not digits */
+	address_lv[0] = da_len_bytes;
+	/* convert to real number */
+	decode_bcd_number(sms->dest_addr, sizeof(sms->dest_addr), address_lv);
+
+	smsp += da_len_bytes;
 
 	sms->pid = *smsp++;
+
 	sms->dcs = *smsp++;
-	switch (sms->vpf)
-	{
-	case 2: /* relative */
-		sms->vp = *smsp++;
+	sms->alphabet = gsm338_get_sms_alphabet(sms->dcs);
+
+	switch (sms->vpf) {
+	case GSM340_TP_VPF_RELATIVE:
+		sms->vp = smsp++;
+		break;
+	case GSM340_TP_VPF_ABSOLUTE:
+	case GSM340_TP_VPF_ENHANCED:
+		sms->vp = smsp;
+		smsp += 7;
 		break;
 	default:
 		DEBUGP(DSMS, "SMS Validity period not implemented: 0x%02x\n",
 				sms->vpf);
 	}
 	sms->ud_len = *smsp++;
+	if (sms->ud_len)
+		sms->user_data = smsp;
+	else
+		sms->user_data = NULL;
 
-	sms->user_data = (u_int8_t *)gsm_7bit_decode(smsp, sms->ud_len);
+	if (sms->ud_len) {
+		switch (sms->alphabet) {
+		case DCS_7BIT_DEFAULT:
+			gsm_7bit_decode(sms->decoded, smsp, sms->ud_len);
+			break;
+		case DCS_8BIT_DATA:
+		case DCS_UCS2:
+		case DCS_NONE:
+			memcpy(sms->decoded,  sms->user_data, sms->ud_len);
+			break;
+		}
+	}
 
-	DEBUGP(DSMS, "SMS:\nMTI: 0x%02x, VPF: 0x%02x, MR: 0x%02x\n"
-			"PID: 0x%02x, DCS: 0x%02x, UserDataLength: 0x%02x\n"
+	DEBUGP(DSMS, "SMS:\nMTI: 0x%02x, VPF: 0x%02x, MR: 0x%02x "
+			"PID: 0x%02x, DCS: 0x%02x, DA: %s, UserDataLength: 0x%02x "
 			"UserData: \"%s\"\n", sms->mti, sms->vpf, sms->msg_ref,
-			sms->pid, sms->dcs, sms->ud_len, sms->user_data);
+			sms->pid, sms->dcs, sms->dest_addr, sms->ud_len,
+			sms->alphabet == DCS_7BIT_DEFAULT ? sms->decoded : hexdump(sms->user_data, sms->ud_len));
 
 	dispatch_signal(SS_SMS, 0, sms);
 
-	free(sms->user_data);
+	gsms->sender = msg->lchan->subscr;
+	/* FIXME: sender refcount */
+
+	/* determine gsms->receiver based on dialled number */
+	gsms->receiver = subscr_get_by_extension(sms->dest_addr);
+	if (!gsms->receiver) {
+		rc = 1; /* cause 1: unknown subscriber */
+		goto out;
+	}
+
+	if (sms->user_data)
+		strncpy(gsms->text, sms->decoded, sizeof(gsms->text));
+
+	switch (sms->mti) {
+	case GSM340_SMS_SUBMIT_MS2SC:
+		/* MS is submitting a SMS */
+		rc = gsm340_rx_sms_submit(msg, sms, gsms);
+		break;
+	case GSM340_SMS_COMMAND_MS2SC:
+	case GSM340_SMS_DELIVER_REP_MS2SC:
+		DEBUGP(DSMS, "Unimplemented MTI 0x%02x\n", sms->mti);
+		break;
+	default:
+		DEBUGP(DSMS, "Undefined MTI 0x%02x\n", sms->mti);
+		break;
+	}
+
+out:
+	free(gsms);
 	free(sms);
 
-	return 0;
+	return rc;
 }
 
 static int gsm411_send_rp_ack(struct gsm_lchan *lchan, u_int8_t trans_id,
@@ -135,9 +297,8 @@
 	return gsm0411_sendmsg(msg);
 }
 
-#if 0
 static int gsm411_send_rp_error(struct gsm_lchan *lchan, u_int8_t trans_id,
-		u_int8_t msg_ref)
+		u_int8_t msg_ref, u_int8_t cause)
 {
 	struct msgb *msg = gsm411_msgb_alloc();
 	struct gsm48_hdr *gh;
@@ -153,31 +314,91 @@
 	rp = (struct gsm411_rp_hdr *)msgb_put(msg, sizeof(*rp));
 	rp->msg_type = GSM411_MT_RP_ERROR_MT;
 	rp->msg_ref = msg_ref;
+	msgb_tv_put(msg, 1, cause);
 
-	DEBUGP(DSMS, "TX: SMS RP ERROR\n");
+	DEBUGP(DSMS, "TX: SMS RP ERROR (cause %02d)\n", cause);
 
 	return gsm0411_sendmsg(msg);
 }
-#endif
 
-static int gsm411_cp_data(struct msgb *msg)
+/* Receive a 04.11 TPDU inside RP-DATA / user data */
+static int gsm411_rx_rp_ud(struct msgb *msg, struct gsm411_rp_hdr *rph,
+			  u_int8_t src_len, u_int8_t *src,
+			  u_int8_t dst_len, u_int8_t *dst,
+			  u_int8_t tpdu_len, u_int8_t *tpdu)
 {
 	struct gsm48_hdr *gh = msgb_l3(msg);
+	u_int8_t trans_id = gh->proto_discr >> 4;
 	int rc = 0;
 
+	if (src_len && src)
+		DEBUGP(DSMS, "RP-DATA (MO) with SRC ?!?\n");
+
+	if (!dst_len || !dst || !tpdu_len || !tpdu) {
+		DEBUGP(DSMS, "RP-DATA (MO) without DST or TPDU ?!?\n");
+		return -EIO;
+	}
+	msg->smsh = tpdu;
+
+	DEBUGP(DSMS, "DST(%u,%s)\n", dst_len, hexdump(dst, dst_len));
+	//return gsm411_send_rp_error(msg->lchan, trans_id, rph->msg_ref, rc);
+
+	rc = gsm340_rx_tpdu(msg);
+	if (rc == 0)
+		return gsm411_send_rp_ack(msg->lchan, trans_id, rph->msg_ref);
+	else if (rc > 0)
+		return gsm411_send_rp_error(msg->lchan, trans_id, rph->msg_ref, rc);
+	else
+		return rc;
+}
+
+/* Receive a 04.11 RP-DATA message in accordance with Section 7.3.1.2 */
+static int gsm411_rx_rp_data(struct msgb *msg, struct gsm411_rp_hdr *rph)
+{
+	u_int8_t src_len, dst_len, rpud_len;
+	u_int8_t *src = NULL, *dst = NULL , *rp_ud = NULL;
+
+	/* in the MO case, this should always be zero length */
+	src_len = rph->data[0];
+	if (src_len)
+		src = &rph->data[1];
+
+	dst_len = rph->data[1+src_len];
+	if (dst_len)
+		dst = &rph->data[1+src_len+1];
+
+	rpud_len = rph->data[1+src_len+1+dst_len];
+	if (rpud_len)
+		rp_ud = &rph->data[1+src_len+1+dst_len+1];
+
+	DEBUGP(DSMS, "RX_RP-DATA: src_len=%u, dst_len=%u ud_len=%u\n", src_len, dst_len, rpud_len);
+	return gsm411_rx_rp_ud(msg, rph, src_len, src, dst_len, dst,
+				rpud_len, rp_ud);
+}
+
+static int gsm411_rx_cp_data(struct msgb *msg, struct gsm48_hdr *gh)
+{
 	struct gsm411_rp_hdr *rp_data = (struct gsm411_rp_hdr*)&gh->data;
 	u_int8_t msg_type =  rp_data->msg_type & 0x07;
+	int rc = 0;
 
 	switch (msg_type) {
 	case GSM411_MT_RP_DATA_MO:
 		DEBUGP(DSMS, "SMS RP-DATA (MO)\n");
-		/* Skip SMSC no and RP-UD length */
-		msg->smsh = &rp_data->data[1] + rp_data->data[1] + 2;
-		gsm411_sms_submit_from_msgb(msg);
-		gsm411_send_rp_ack(msg->lchan, (gh->proto_discr & 0xf0)>>4, rp_data->msg_ref);
+		rc = gsm411_rx_rp_data(msg, rp_data);
+		break;
+	case GSM411_MT_RP_ACK_MO:
+		/* Acnkowledgement to MT RP_DATA */
+	case GSM411_MT_RP_ERROR_MO:
+		/* Error in response to MT RP_DATA */
+	case GSM411_MT_RP_SMMA_MO:
+		/* MS tells us that it has memory for more SMS, we need
+		 * to check if we have any pending messages for it and then
+		 * transfer those */
+		DEBUGP(DSMS, "Unimplemented RP type 0x%02x\n", msg_type);
 		break;
 	default:
-		DEBUGP(DSMS, "Unimplemented RP type 0x%02x\n", msg_type);
+		DEBUGP(DSMS, "Invalid RP type 0x%02x\n", msg_type);
 		break;
 	}
 
@@ -190,12 +411,10 @@
 	u_int8_t msg_type = gh->msg_type;
 	int rc = 0;
 
-	DEBUGP(DSMS, "SMS Message\n");
-
 	switch(msg_type) {
 	case GSM411_MT_CP_DATA:
 		DEBUGP(DSMS, "SMS CP-DATA\n");
-		rc = gsm411_cp_data(msg);
+		rc = gsm411_rx_cp_data(msg, gh);
 		break;
 	case GSM411_MT_CP_ACK:
 		DEBUGP(DSMS, "SMS CP-ACK\n");
@@ -279,4 +498,3 @@
 
 	return gsm0411_sendmsg(msg);
 }
-
diff --git a/src/gsm_utils.c b/src/gsm_utils.c
index d8e0859..b0594ae 100644
--- a/src/gsm_utils.c
+++ b/src/gsm_utils.c
@@ -1,6 +1,7 @@
 /*
  * (C) 2008 by Daniel Willmann <daniel@totalueberwachung.de>
  * (C) 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2009 by Harald Welte <laforge@gnumonks.org>
  *
  * All Rights Reserved
  *
@@ -25,13 +26,10 @@
 #include <string.h>
 
 /* GSM 03.38 6.2.1 Charachter packing */
-char *gsm_7bit_decode(u_int8_t *user_data, u_int8_t length)
+int gsm_7bit_decode(char *text, const u_int8_t *user_data, u_int8_t length)
 {
 	u_int8_t d_off = 0, b_off = 0;
 	u_int8_t i;
-	char *text = malloc(length+1);
-	if (!text)
-		return NULL;
 
 	for (i=0;i<length;i++) {
 		text[i] = ((user_data[d_off] + (user_data[d_off+1]<<8)) & (0x7f<<b_off))>>b_off;
@@ -42,21 +40,18 @@
 		}
 	}
 	text[i] = '\0';
-	return text;
+	return 0;
 }
 
 /* GSM 03.38 6.2.1 Charachter packing */
-u_int8_t *gsm_7bit_encode(const char *data, u_int8_t *out_length)
+int gsm_7bit_encode(u_int8_t *result, const char *data)
 {
 	int i;
 	u_int8_t d_off = 0, b_off = 0;
 	const int length = strlen(data);
-	*out_length = (length * 8)/7;
-	u_int8_t *result = malloc(*out_length);
-	if (!result)
-		return NULL;
+	int out_length = (length * 8)/7;
 
-	memset(result, 0, *out_length);
+	memset(result, 0, out_length);
 
 	for (i = 0; i < length; ++i) {
 		u_int8_t first  = (data[i] & 0x7f) << b_off;
@@ -74,5 +69,5 @@
 		}
 	}
 
-	return result;
+	return out_length;
 }
diff --git a/tests/sms/sms_test.c b/tests/sms/sms_test.c
index bd628d1..2b55b97 100644
--- a/tests/sms/sms_test.c
+++ b/tests/sms/sms_test.c
@@ -80,8 +80,11 @@
         /* test 7-bit coding/decoding */
 	const char *input = "test text";
 	u_int8_t length;
-	u_int8_t *coded = gsm_7bit_encode(input, &length);
-	char *result = gsm_7bit_decode(coded, length);
+	u_int8_t coded[256];
+	char result[256];
+
+	length = gsm_7bit_encode(coded, input);
+	gsm_7bit_decode(result, coded, length);
 	if (strcmp(result, input) != 0) {
 		printf("7 Bit coding failed... life sucks\n");
 		printf("Wanted: '%s' got '%s'\n", input, result);