diff --git a/src/gsm_04_11.c b/src/gsm_04_11.c
index 35fc12e..c299538 100644
--- a/src/gsm_04_11.c
+++ b/src/gsm_04_11.c
@@ -3,6 +3,7 @@
  * 3GPP TS 04.11 version 7.1.0 Release 1998 / ETSI TS 100 942 V7.1.0 */
 
 /* (C) 2008 by Daniel Willmann <daniel@totalueberwachung.de>
+ * (C) 2009 by Harald Welte <laforge@gnumonks.org>
  *
  * All Rights Reserved
  *
@@ -30,6 +31,7 @@
 #include <netinet/in.h>
 
 #include <openbsc/msgb.h>
+#include <openbsc/tlv.h>
 #include <openbsc/debug.h>
 #include <openbsc/gsm_data.h>
 #include <openbsc/gsm_subscriber.h>
@@ -38,6 +40,7 @@
 #include <openbsc/gsm_utils.h>
 #include <openbsc/abis_rsl.h>
 #include <openbsc/signal.h>
+#include <openbsc/db.h>
 
 #define GSM411_ALLOC_SIZE	1024
 #define GSM411_ALLOC_HEADROOM	128
@@ -64,12 +67,108 @@
 }
 #endif
 
-static int gsm411_sms_submit_from_msgb(struct msgb *msg)
+static unsigned long gsm340_validity_period(struct sms_submit *sms)
+{
+	u_int8_t vp;
+	unsigned long minutes;
+
+	switch (sms->vpf) {
+	case GSM340_TP_VPF_RELATIVE:
+		/* Chapter 9.2.3.12.1 */
+		vp = *(sms->vp);
+		if (vp <= 143)
+			minutes = vp + 1 * 5;
+		else if (vp <= 167)
+			minutes = 12*60 + (vp-143) * 30;
+		else if (vp <= 196)
+			minutes = vp-166 * 60 * 24;
+		else
+			minutes = vp-192 * 60 * 24 * 7;
+		break;
+	case GSM340_TP_VPF_ABSOLUTE:
+		/* Chapter 9.2.3.12.2 */
+		/* FIXME: like service center time stamp */
+		DEBUGP(DSMS, "VPI absolute not implemented yet\n");
+		break;
+	case GSM340_TP_VPF_ENHANCED:
+		/* Chapter 9.2.3.12.3 */
+		/* FIXME: implementation */
+		DEBUGP(DSMS, "VPI enhanced not implemented yet\n");
+		break;
+	}
+	return minutes;
+}
+
+/* determine coding alphabet dependent on GSM 03.38 Section 4 DCS */
+enum sms_alphabet gsm338_get_sms_alphabet(u_int8_t dcs)
+{
+	u_int8_t cgbits = dcs >> 4;
+	enum sms_alphabet alpha = DCS_NONE;
+
+	if ((cgbits & 0xc) == 0) {
+		if (cgbits & 2)
+			DEBUGP(DSMS, "Compressed SMS not supported yet\n");
+
+		switch (dcs & 3) {
+		case 0:
+			alpha = DCS_7BIT_DEFAULT;
+			break;
+		case 1:
+			alpha = DCS_8BIT_DATA;
+			break;
+		case 2:
+			alpha = DCS_UCS2;
+			break;
+		}
+	} else if (cgbits == 0xc || cgbits == 0xd)
+		alpha = DCS_7BIT_DEFAULT;
+	else if (cgbits == 0xe)
+		alpha = DCS_UCS2;
+	else if (cgbits == 0xf) {
+		if (dcs & 4)
+			alpha = DCS_8BIT_DATA;
+		else
+			alpha = DCS_7BIT_DEFAULT;
+	}
+
+	return alpha;
+}
+
+static int gsm340_rx_sms_submit(struct msgb *msg, struct sms_submit *sms,
+				struct gsm_sms *gsms)
+{
+	if (db_sms_store(gsms) != 0) {
+		DEBUGP(DSMS, "Failed to store SMS in Database\n");
+		free(sms);
+		free(gsms);
+		return -EIO;
+	}
+	return 0;
+}
+
+/* process an incoming TPDU (called from RP-DATA) */
+static int gsm340_rx_tpdu(struct msgb *msg)
 {
 	u_int8_t *smsp = msgb_sms(msg);
 	struct sms_submit *sms;
+	struct gsm_sms *gsms;
+	u_int8_t da_len_bytes;
+	u_int8_t address_lv[12]; /* according to 03.40 / 9.1.2.5 */
+	int rc = 0;
 
 	sms = malloc(sizeof(*sms));
+	if (!sms)
+		return -ENOMEM;
+	memset(sms, 0, sizeof(*sms));
+
+	gsms = malloc(sizeof(*gsms));
+	if (!gsms) {
+		free(sms);
+		return -ENOMEM;
+	}
+	memset(gsms, 0, sizeof(*gsms));
+
+	/* invert those fields where 0 means active/present */
 	sms->mti = *smsp & 0x03;
 	sms->mms = !!(*smsp & 0x04);
 	sms->vpf = (*smsp & 0x18) >> 3;
@@ -80,35 +179,98 @@
 	smsp++;
 	sms->msg_ref = *smsp++;
 
-	/* Skip destination address for now */
-	smsp += 2 + *smsp/2 + *smsp%2;
+	/* length in bytes of the destination address */
+	da_len_bytes = 2 + *smsp/2 + *smsp%2;
+	if (da_len_bytes > 12) {
+		DEBUGP(DSMS, "Destination Address > 12 bytes ?!?\n");
+		rc = -EIO;
+		goto out;
+	}
+	memcpy(address_lv, smsp, da_len_bytes);
+	/* mangle first byte to reflect length in bytes, not digits */
+	address_lv[0] = da_len_bytes;
+	/* convert to real number */
+	decode_bcd_number(sms->dest_addr, sizeof(sms->dest_addr), address_lv);
+
+	smsp += da_len_bytes;
 
 	sms->pid = *smsp++;
+
 	sms->dcs = *smsp++;
-	switch (sms->vpf)
-	{
-	case 2: /* relative */
-		sms->vp = *smsp++;
+	sms->alphabet = gsm338_get_sms_alphabet(sms->dcs);
+
+	switch (sms->vpf) {
+	case GSM340_TP_VPF_RELATIVE:
+		sms->vp = smsp++;
+		break;
+	case GSM340_TP_VPF_ABSOLUTE:
+	case GSM340_TP_VPF_ENHANCED:
+		sms->vp = smsp;
+		smsp += 7;
 		break;
 	default:
 		DEBUGP(DSMS, "SMS Validity period not implemented: 0x%02x\n",
 				sms->vpf);
 	}
 	sms->ud_len = *smsp++;
+	if (sms->ud_len)
+		sms->user_data = smsp;
+	else
+		sms->user_data = NULL;
 
-	sms->user_data = (u_int8_t *)gsm_7bit_decode(smsp, sms->ud_len);
+	if (sms->ud_len) {
+		switch (sms->alphabet) {
+		case DCS_7BIT_DEFAULT:
+			gsm_7bit_decode(sms->decoded, smsp, sms->ud_len);
+			break;
+		case DCS_8BIT_DATA:
+		case DCS_UCS2:
+		case DCS_NONE:
+			memcpy(sms->decoded,  sms->user_data, sms->ud_len);
+			break;
+		}
+	}
 
-	DEBUGP(DSMS, "SMS:\nMTI: 0x%02x, VPF: 0x%02x, MR: 0x%02x\n"
-			"PID: 0x%02x, DCS: 0x%02x, UserDataLength: 0x%02x\n"
+	DEBUGP(DSMS, "SMS:\nMTI: 0x%02x, VPF: 0x%02x, MR: 0x%02x "
+			"PID: 0x%02x, DCS: 0x%02x, DA: %s, UserDataLength: 0x%02x "
 			"UserData: \"%s\"\n", sms->mti, sms->vpf, sms->msg_ref,
-			sms->pid, sms->dcs, sms->ud_len, sms->user_data);
+			sms->pid, sms->dcs, sms->dest_addr, sms->ud_len,
+			sms->alphabet == DCS_7BIT_DEFAULT ? sms->decoded : hexdump(sms->user_data, sms->ud_len));
 
 	dispatch_signal(SS_SMS, 0, sms);
 
-	free(sms->user_data);
+	gsms->sender = msg->lchan->subscr;
+	/* FIXME: sender refcount */
+
+	/* determine gsms->receiver based on dialled number */
+	gsms->receiver = subscr_get_by_extension(sms->dest_addr);
+	if (!gsms->receiver) {
+		rc = 1; /* cause 1: unknown subscriber */
+		goto out;
+	}
+
+	if (sms->user_data)
+		strncpy(gsms->text, sms->decoded, sizeof(gsms->text));
+
+	switch (sms->mti) {
+	case GSM340_SMS_SUBMIT_MS2SC:
+		/* MS is submitting a SMS */
+		rc = gsm340_rx_sms_submit(msg, sms, gsms);
+		break;
+	case GSM340_SMS_COMMAND_MS2SC:
+	case GSM340_SMS_DELIVER_REP_MS2SC:
+		DEBUGP(DSMS, "Unimplemented MTI 0x%02x\n", sms->mti);
+		break;
+	default:
+		DEBUGP(DSMS, "Undefined MTI 0x%02x\n", sms->mti);
+		break;
+	}
+
+out:
+	free(gsms);
 	free(sms);
 
-	return 0;
+	return rc;
 }
 
 static int gsm411_send_rp_ack(struct gsm_lchan *lchan, u_int8_t trans_id,
@@ -135,9 +297,8 @@
 	return gsm0411_sendmsg(msg);
 }
 
-#if 0
 static int gsm411_send_rp_error(struct gsm_lchan *lchan, u_int8_t trans_id,
-		u_int8_t msg_ref)
+		u_int8_t msg_ref, u_int8_t cause)
 {
 	struct msgb *msg = gsm411_msgb_alloc();
 	struct gsm48_hdr *gh;
@@ -153,31 +314,91 @@
 	rp = (struct gsm411_rp_hdr *)msgb_put(msg, sizeof(*rp));
 	rp->msg_type = GSM411_MT_RP_ERROR_MT;
 	rp->msg_ref = msg_ref;
+	msgb_tv_put(msg, 1, cause);
 
-	DEBUGP(DSMS, "TX: SMS RP ERROR\n");
+	DEBUGP(DSMS, "TX: SMS RP ERROR (cause %02d)\n", cause);
 
 	return gsm0411_sendmsg(msg);
 }
-#endif
 
-static int gsm411_cp_data(struct msgb *msg)
+/* Receive a 04.11 TPDU inside RP-DATA / user data */
+static int gsm411_rx_rp_ud(struct msgb *msg, struct gsm411_rp_hdr *rph,
+			  u_int8_t src_len, u_int8_t *src,
+			  u_int8_t dst_len, u_int8_t *dst,
+			  u_int8_t tpdu_len, u_int8_t *tpdu)
 {
 	struct gsm48_hdr *gh = msgb_l3(msg);
+	u_int8_t trans_id = gh->proto_discr >> 4;
 	int rc = 0;
 
+	if (src_len && src)
+		DEBUGP(DSMS, "RP-DATA (MO) with SRC ?!?\n");
+
+	if (!dst_len || !dst || !tpdu_len || !tpdu) {
+		DEBUGP(DSMS, "RP-DATA (MO) without DST or TPDU ?!?\n");
+		return -EIO;
+	}
+	msg->smsh = tpdu;
+
+	DEBUGP(DSMS, "DST(%u,%s)\n", dst_len, hexdump(dst, dst_len));
+	//return gsm411_send_rp_error(msg->lchan, trans_id, rph->msg_ref, rc);
+
+	rc = gsm340_rx_tpdu(msg);
+	if (rc == 0)
+		return gsm411_send_rp_ack(msg->lchan, trans_id, rph->msg_ref);
+	else if (rc > 0)
+		return gsm411_send_rp_error(msg->lchan, trans_id, rph->msg_ref, rc);
+	else
+		return rc;
+}
+
+/* Receive a 04.11 RP-DATA message in accordance with Section 7.3.1.2 */
+static int gsm411_rx_rp_data(struct msgb *msg, struct gsm411_rp_hdr *rph)
+{
+	u_int8_t src_len, dst_len, rpud_len;
+	u_int8_t *src = NULL, *dst = NULL , *rp_ud = NULL;
+
+	/* in the MO case, this should always be zero length */
+	src_len = rph->data[0];
+	if (src_len)
+		src = &rph->data[1];
+
+	dst_len = rph->data[1+src_len];
+	if (dst_len)
+		dst = &rph->data[1+src_len+1];
+
+	rpud_len = rph->data[1+src_len+1+dst_len];
+	if (rpud_len)
+		rp_ud = &rph->data[1+src_len+1+dst_len+1];
+
+	DEBUGP(DSMS, "RX_RP-DATA: src_len=%u, dst_len=%u ud_len=%u\n", src_len, dst_len, rpud_len);
+	return gsm411_rx_rp_ud(msg, rph, src_len, src, dst_len, dst,
+				rpud_len, rp_ud);
+}
+
+static int gsm411_rx_cp_data(struct msgb *msg, struct gsm48_hdr *gh)
+{
 	struct gsm411_rp_hdr *rp_data = (struct gsm411_rp_hdr*)&gh->data;
 	u_int8_t msg_type =  rp_data->msg_type & 0x07;
+	int rc = 0;
 
 	switch (msg_type) {
 	case GSM411_MT_RP_DATA_MO:
 		DEBUGP(DSMS, "SMS RP-DATA (MO)\n");
-		/* Skip SMSC no and RP-UD length */
-		msg->smsh = &rp_data->data[1] + rp_data->data[1] + 2;
-		gsm411_sms_submit_from_msgb(msg);
-		gsm411_send_rp_ack(msg->lchan, (gh->proto_discr & 0xf0)>>4, rp_data->msg_ref);
+		rc = gsm411_rx_rp_data(msg, rp_data);
+		break;
+	case GSM411_MT_RP_ACK_MO:
+		/* Acnkowledgement to MT RP_DATA */
+	case GSM411_MT_RP_ERROR_MO:
+		/* Error in response to MT RP_DATA */
+	case GSM411_MT_RP_SMMA_MO:
+		/* MS tells us that it has memory for more SMS, we need
+		 * to check if we have any pending messages for it and then
+		 * transfer those */
+		DEBUGP(DSMS, "Unimplemented RP type 0x%02x\n", msg_type);
 		break;
 	default:
-		DEBUGP(DSMS, "Unimplemented RP type 0x%02x\n", msg_type);
+		DEBUGP(DSMS, "Invalid RP type 0x%02x\n", msg_type);
 		break;
 	}
 
@@ -190,12 +411,10 @@
 	u_int8_t msg_type = gh->msg_type;
 	int rc = 0;
 
-	DEBUGP(DSMS, "SMS Message\n");
-
 	switch(msg_type) {
 	case GSM411_MT_CP_DATA:
 		DEBUGP(DSMS, "SMS CP-DATA\n");
-		rc = gsm411_cp_data(msg);
+		rc = gsm411_rx_cp_data(msg, gh);
 		break;
 	case GSM411_MT_CP_ACK:
 		DEBUGP(DSMS, "SMS CP-ACK\n");
@@ -279,4 +498,3 @@
 
 	return gsm0411_sendmsg(msg);
 }
-