diff --git a/include/openbsc/abis_rsl.h b/include/openbsc/abis_rsl.h
index 3109454..b6d9a9d 100644
--- a/include/openbsc/abis_rsl.h
+++ b/include/openbsc/abis_rsl.h
@@ -55,6 +55,7 @@
 #define ABIS_RSL_MDISC_TRX		0x10
 #define ABIS_RSL_MDISC_LOC		0x20
 #define ABIS_RSL_MDISC_IPACCESS		0x7e
+#define ABIS_RSL_MDISC_TRANSP		0x01
 
 #define ABIS_RSL_MDISC_IS_TRANSP(x)	(x & 0x01)
 
diff --git a/include/openbsc/gsm_04_08.h b/include/openbsc/gsm_04_08.h
index d9f6ec3..a27236f 100644
--- a/include/openbsc/gsm_04_08.h
+++ b/include/openbsc/gsm_04_08.h
@@ -407,6 +407,21 @@
 /* Section 10.5.4.11 / Table 10.5.122 */
 #define GSM48_CAUSE_CS_GSM	0x60
 
+/* Section 9.1.2 / Table 9.3 */
+#define GSM48_IE_FRQLIST_AFTER	0x05
+#define GSM48_IE_CELL_CH_DESC	0x62
+#define GSM48_IE_MSLOT_DESC	0x10
+#define GSM48_IE_CHANMODE_1	0x63
+#define GSM48_IE_CHANMODE_2	0x11
+#define GSM48_IE_CHANMODE_3	0x13
+#define GSM48_IE_CHANMODE_4	0x14
+#define GSM48_IE_CHANMODE_5	0x15
+#define GSM48_IE_CHANMODE_6	0x16
+#define GSM48_IE_CHANMODE_7	0x17
+#define GSM48_IE_CHANMODE_8	0x18
+#define GSM48_IE_CHANDESC_2	0x64
+/* FIXME */
+
 /* Section 10.5.4.23 / Table 10.5.130 */
 enum gsm48_signal_val {
 	GSM48_SIGNAL_DIALTONE	= 0x00,
diff --git a/src/abis_rsl.c b/src/abis_rsl.c
index 8df109c..918255c 100644
--- a/src/abis_rsl.c
+++ b/src/abis_rsl.c
@@ -402,6 +402,7 @@
 	struct rsl_ie_chan_mode cm;
 	struct rsl_ie_chan_ident ci;
 
+	memset(&cm, 0, sizeof(cm));
 	/* FIXME: what to do with data calls ? */
 	cm.dtx_dtu = 0x00;
 	switch (lchan->type) {
@@ -462,13 +463,15 @@
 	u_int8_t chan_nr = lchan2chan_nr(lchan);
 	struct rsl_ie_chan_mode cm;
 
+	memset(&cm, 0, sizeof(cm));
+
 	/* FIXME: what to do with data calls ? */
 	cm.dtx_dtu = 0x00;
 	switch (lchan->type) {
 	case GSM_LCHAN_TCH_F:
 		cm.spd_ind = RSL_CMOD_SPD_SPEECH;
 		cm.chan_rt = RSL_CMOD_CRT_TCH_Bm;
-		cm.chan_rate = 0x11; /* speech coding alg version 2*/
+		cm.chan_rate = RSL_CMOD_SP_GSM2;
 		break;
 	default:
 		DEBUGP(DRSL, "Unimplemented channel modification\n");
@@ -603,6 +606,7 @@
 	/* Then push the RSL header */
 	rh = (struct abis_rsl_rll_hdr *) msgb_push(msg, sizeof(*rh));
 	init_llm_hdr(rh, RSL_MT_DATA_REQ);
+	rh->c.msg_discr |= ABIS_RSL_MDISC_TRANSP;
 	rh->chan_nr = lchan2chan_nr(msg->lchan);
 	rh->link_id = link_id;
 
@@ -820,9 +824,10 @@
 	ia.mob_alloc_len = 0;
 
 	DEBUGP(DRSL, "Activating ARFCN(%u) TS(%u) SS(%u) lctype %s "
-		"chan_nr=0x%02x r=%s\n",
+		"chan_nr=0x%02x r=%s\n ra=0x%02x",
 		arfcn, ts_number, subch, gsm_lchan_name(lchan->type),
-		ia.chan_desc.chan_nr, gsm_chreq_name(chreq_reason));
+		ia.chan_desc.chan_nr, gsm_chreq_name(chreq_reason),
+		rqd_ref->ra);
 
 	/* FIXME: Start timer T3101 to wait for GSM48_MT_RR_PAG_RESP */
 
@@ -921,15 +926,21 @@
 	switch (rllh->c.msg_type) {
 	case RSL_MT_DATA_IND:
 		DEBUGPC(DRLL, "DATA INDICATION\n");
-		/* FIXME: Verify L3 info element */
-		msg->l3h = &rllh->data[3];
-		return gsm0408_rcvmsg(msg);
+		if (msgb_l2len(msg) > 
+		    sizeof(struct abis_rsl_common_hdr) + sizeof(*rllh) &&
+		    rllh->data[0] == RSL_IE_L3_INFO) {
+			msg->l3h = &rllh->data[3];
+			return gsm0408_rcvmsg(msg);
+		}
 		break;
 	case RSL_MT_EST_IND:
 		DEBUGPC(DRLL, "ESTABLISH INDICATION\n");
-		/* FIXME: Verify L3 info element */
-		msg->l3h = &rllh->data[3];
-		return gsm0408_rcvmsg(msg);
+		if (msgb_l2len(msg) > 
+		    sizeof(struct abis_rsl_common_hdr) + sizeof(*rllh) &&
+		    rllh->data[0] == RSL_IE_L3_INFO) {
+			msg->l3h = &rllh->data[3];
+			return gsm0408_rcvmsg(msg);
+		}
 		break;
 	case RSL_MT_REL_IND:
 		DEBUGPC(DRLL, "RELEASE INDICATION ");
@@ -1071,7 +1082,7 @@
 	
 	switch (rllh->c.msg_type) {
 	case RSL_MT_IPAC_BIND_ACK:
-		DEBUGP(DRSL, "IPAC_BIND_ACK ");
+		DEBUGPC(DRSL, "IPAC_BIND_ACK ");
 		rc = abis_rsl_rx_ipacc_bindack(msg);
 		break;
 	case RSL_MT_IPAC_BIND_NACK:
diff --git a/src/gsm_04_08.c b/src/gsm_04_08.c
index 574e6c1..936d72f 100644
--- a/src/gsm_04_08.c
+++ b/src/gsm_04_08.c
@@ -611,9 +611,9 @@
 	struct gsm48_hdr *gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh));
 	struct gsm48_chan_mode_modify *cmm =
 		(struct gsm48_chan_mode_modify *) msgb_put(msg, sizeof(*cmm));
-	u_int16_t arfcn = lchan->ts->trx->arfcn;
+	u_int16_t arfcn = lchan->ts->trx->arfcn & 0x3ff;
 
-	DEBUGP(DRR, "-> CHANNEL MODE MODIFY\n");
+	DEBUGP(DRR, "-> CHANNEL MODE MODIFY mode=0x%02x\n", mode);
 
 	msg->lchan = lchan;
 	gh->proto_discr = GSM48_PDISC_RR;
@@ -1054,6 +1054,7 @@
 
 static int gsm48_cc_rx_status_enq(struct msgb *msg)
 {
+	DEBUGP(DCC, "-> STATUS ENQ\n");
 	return gsm48_cc_tx_status(msg->lchan);
 }
 
@@ -1314,12 +1315,23 @@
 		rc = gsm48_cc_rx_disconnect(msg);
 		break;
 	case GSM48_MT_CC_SETUP:
+		/* MO: wants to establish a call */
 		rc = gsm48_cc_rx_setup(msg);
 		break;
 	case GSM48_MT_CC_EMERG_SETUP:
 		DEBUGP(DCC, "-> EMERGENCY SETUP\n");
 		/* FIXME: continue with CALL_PROCEEDING, ALERTING, CONNECT, RELEASE_COMPLETE */
 		break;
+	case GSM48_MT_CC_HOLD:
+		DEBUGP(DCC, "-> HOLD (rejecting)\n");
+		rc = gsm48_tx_simple(msg->lchan, GSM48_PDISC_CC,
+				     GSM48_MT_CC_HOLD_REJ);
+		break;
+	case GSM48_MT_CC_RETR:
+		DEBUGP(DCC, "-> RETR (rejecting)\n");
+		rc = gsm48_tx_simple(msg->lchan, GSM48_PDISC_CC,
+				     GSM48_MT_CC_RETR_REJ);
+		break;
 	default:
 		fprintf(stderr, "Unimplemented GSM 04.08 CC msg type 0x%02x\n",
 			msg_type);