diff --git a/openbsc/src/bsc_hack.c b/openbsc/src/bsc_hack.c
index 47f53cd..9945aa9 100644
--- a/openbsc/src/bsc_hack.c
+++ b/openbsc/src/bsc_hack.c
@@ -930,6 +930,8 @@
 		(struct gsm48_system_information_type_3*)&si3;
 	struct gsm48_system_information_type_4 *type_4 =
 		(struct gsm48_system_information_type_4*)&si4;
+	struct gsm48_system_information_type_5 *type_5 =
+		(struct gsm48_system_information_type_5*)&si5;
 	struct gsm48_system_information_type_6 *type_6 =
 		(struct gsm48_system_information_type_6*)&si6;
 	struct gsm48_loc_area_id lai;
@@ -969,6 +971,17 @@
 		type_3->rach_control.cell_bar = 0;
 		type_4->rach_control.cell_bar = 0;
 	}
+
+	/* FIXME: This is just for HAR */
+	if (bts->c0->arfcn == 121) {
+		/* this is setting pin 124 */
+		type_2->bcch_frequency_list[0] = 0x08;
+		type_5->bcch_frequency_list[0] = 0x08;
+	} else if (bts->c0->arfcn == 124) {
+		/* this is setting pin 121 */
+		type_2->bcch_frequency_list[0] = 0x01;
+		type_5->bcch_frequency_list[0] = 0x01;
+	}
 }
 
 
diff --git a/openbsc/src/db.c b/openbsc/src/db.c
index 16a7f6a..45e950b 100644
--- a/openbsc/src/db.c
+++ b/openbsc/src/db.c
@@ -24,6 +24,7 @@
 #include <openbsc/gsm_04_11.h>
 #include <openbsc/db.h>
 #include <openbsc/talloc.h>
+#include <openbsc/debug.h>
 
 #include <libgen.h>
 #include <stdio.h>
@@ -260,6 +261,53 @@
 	return subscr;
 }
 
+static int get_equipment_by_subscr(struct gsm_subscriber *subscr)
+{
+	dbi_result result;
+	char *string;
+	unsigned int cm1;
+	const unsigned char *cm2, *cm3;
+	struct gsm_equipment *equip = &subscr->equipment;
+
+	result = dbi_conn_queryf(conn,
+				"SELECT equipment.* FROM equipment,equipmentwatch "
+				"WHERE equipmentwatch.equipment_id=equipment.id "
+				"AND equipmentwatch.subscriber_id = %llu "
+				"ORDER BY updated DESC", subscr->id);
+	if (!result)
+		return -EIO;
+
+	if (!dbi_result_next_row(result)) {
+		dbi_result_free(result);
+		return -ENOENT;
+	}
+
+	equip->id = dbi_result_get_ulonglong(result, "id");
+
+	string = dbi_result_get_string(result, "imei");
+	if (string)
+		strncpy(equip->imei, string, sizeof(equip->imei));
+
+	cm1 = dbi_result_get_uint(result, "classmark1") & 0xff;
+	equip->classmark1 = *((struct gsm48_classmark1 *) &cm1);
+
+	equip->classmark2_len = dbi_result_get_field_length(result, "classmark2");
+	cm2 = dbi_result_get_binary(result, "classmark2");
+	if (equip->classmark2_len > sizeof(equip->classmark2))
+		equip->classmark2_len = sizeof(equip->classmark2);
+	memcpy(equip->classmark2, cm2, equip->classmark2_len);
+
+	equip->classmark3_len = dbi_result_get_field_length(result, "classmark3");
+	cm3 = dbi_result_get_binary(result, "classmark3");
+	if (equip->classmark3_len > sizeof(equip->classmark3))
+		equip->classmark3_len = sizeof(equip->classmark3);
+	memcpy(equip->classmark3, cm3, equip->classmark3_len);
+
+	dbi_result_free(result);
+
+	return 0;
+}
+#define BASE_QUERY "SELECT * FROM Subscriber "
 struct gsm_subscriber *db_get_subscriber(struct gsm_network *net,
 					 enum gsm_subscriber_field field,
 					 const char *id)
@@ -273,7 +321,7 @@
 	case GSM_SUBSCRIBER_IMSI:
 		dbi_conn_quote_string_copy(conn, id, &quoted);
 		result = dbi_conn_queryf(conn,
-			"SELECT * FROM Subscriber "
+			BASE_QUERY
 			"WHERE imsi = %s ",
 			quoted
 		);
@@ -282,7 +330,7 @@
 	case GSM_SUBSCRIBER_TMSI:
 		dbi_conn_quote_string_copy(conn, id, &quoted);
 		result = dbi_conn_queryf(conn,
-			"SELECT * FROM Subscriber "
+			BASE_QUERY
 			"WHERE tmsi = %s ",
 			quoted
 		);
@@ -291,7 +339,7 @@
 	case GSM_SUBSCRIBER_EXTENSION:
 		dbi_conn_quote_string_copy(conn, id, &quoted);
 		result = dbi_conn_queryf(conn,
-			"SELECT * FROM Subscriber "
+			BASE_QUERY
 			"WHERE extension = %s ",
 			quoted
 		);
@@ -300,7 +348,7 @@
 	case GSM_SUBSCRIBER_ID:
 		dbi_conn_quote_string_copy(conn, id, &quoted);
 		result = dbi_conn_queryf(conn,
-			"SELECT * FROM Subscriber "
+			BASE_QUERY
 			"WHERE id = %s ", quoted);
 		free(quoted);
 		break;
@@ -344,6 +392,9 @@
 		subscr->id, subscr->imsi, subscr->name, subscr->tmsi, subscr->extension,
 		subscr->lac, subscr->authorized);
 	dbi_result_free(result);
+
+	get_equipment_by_subscr(subscr);
+
 	return subscr;
 }
 
@@ -386,6 +437,16 @@
 	dbi_result result;
 	unsigned char *cm2, *cm3;
 
+	printf("DB: Sync Equipment IMEI=%s, classmark1=%02x",
+		equip->imei, equip->classmark1);
+	if (equip->classmark2_len)
+ 		printf(", classmark2=%s",
+			hexdump(equip->classmark2, equip->classmark2_len));
+	if (equip->classmark3_len)
+		printf(", classmark3=%s",
+			hexdump(equip->classmark3, equip->classmark3_len));
+	printf("\n");
+
 	dbi_conn_quote_binary_copy(conn, equip->classmark2,
 				   equip->classmark2_len, &cm2);
 	dbi_conn_quote_binary_copy(conn, equip->classmark3,
diff --git a/openbsc/src/gsm_04_08.c b/openbsc/src/gsm_04_08.c
index b64d253..46b4479 100644
--- a/openbsc/src/gsm_04_08.c
+++ b/openbsc/src/gsm_04_08.c
@@ -1165,8 +1165,10 @@
 	case GSM_MI_TYPE_IMEI:
 	case GSM_MI_TYPE_IMEISV:
 		/* update subscribe <-> IMEI mapping */
-		if (lchan->subscr)
+		if (lchan->subscr) {
 			db_subscriber_assoc_imei(lchan->subscr, mi_string);
+			db_sync_equipment(&lchan->subscr->equipment);
+		}
 		if (lchan->loc_operation)
 			lchan->loc_operation->waiting_for_imei = 0;
 		break;
@@ -1289,6 +1291,7 @@
 	}
 
 	lchan->subscr = subscr;
+	lchan->subscr->equipment.classmark1 = lu->classmark1;
 
 	/* check if we can let the subscriber into our network immediately
 	 * or if we need to wait for identity responses. */
@@ -1614,6 +1617,10 @@
 				GSM_SUBSCRIBER_UPDATE_DETACHED);
 		DEBUGP(DMM, "Subscriber: %s\n",
 		       subscr->name ? subscr->name : subscr->imsi);
+
+		subscr->equipment.classmark1 = idi->classmark1;
+		db_sync_equipment(&subscr->equipment);
+
 		subscr_put(subscr);
 	} else
 		DEBUGP(DMM, "Unknown Subscriber ?!?\n");
diff --git a/openbsc/src/gsm_04_11.c b/openbsc/src/gsm_04_11.c
index 277a321..85fd6b6 100644
--- a/openbsc/src/gsm_04_11.c
+++ b/openbsc/src/gsm_04_11.c
@@ -295,6 +295,9 @@
 	}
 	/* dispatch a signal to tell higher level about it */
 	dispatch_signal(SS_SMS, S_SMS_SUBMITTED, gsms);
+	/* try delivering the SMS right now */
+	//gsm411_send_sms_subscr(gsms->receiver, gsms);
+
 	return 0;
 }
 
@@ -675,14 +678,19 @@
 
 	if (!trans->sms.is_mt) {
 		DEBUGP(DSMS, "RX RP-ERR on a MO transfer ?\n");
+#if 0
 		return gsm411_send_rp_error(trans, rph->msg_ref,
 					    GSM411_RP_CAUSE_MSG_INCOMP_STATE);
+#endif
 	}
 
 	if (!sms) {
 		DEBUGP(DSMS, "RX RP-ERR, but no sms in transaction?!?\n");
+		return -EINVAL;
+#if 0
 		return gsm411_send_rp_error(trans, rph->msg_ref,
 					    GSM411_RP_CAUSE_PROTOCOL_ERR);
+#endif
 	}
 
 	if (cause == GSM411_RP_CAUSE_MT_MEM_EXCEEDED) {