diff --git a/library/GSUP_Types.ttcn b/library/GSUP_Types.ttcn
index 6329ebd..9cb3255 100644
--- a/library/GSUP_Types.ttcn
+++ b/library/GSUP_Types.ttcn
@@ -43,7 +43,15 @@
 
 	OSMO_GSUP_SESSION_ID_IE		('30'O),
 	OSMO_GSUP_SESSION_STATE_IE	('31'O),
-	OSMO_GSUP_SS_INFO_IE		('35'O)
+	OSMO_GSUP_SS_INFO_IE		('35'O),
+
+	/* SM related IEs (see 3GPP TS 29.002, section 7.6.8) */
+	OSMO_GSUP_SM_RP_MR_IE		('40'O),
+	OSMO_GSUP_SM_RP_DA_IE		('41'O),
+	OSMO_GSUP_SM_RP_OA_IE		('42'O),
+	OSMO_GSUP_SM_RP_UI_IE		('43'O),
+	OSMO_GSUP_SM_RP_CAUSE_IE	('44'O),
+	OSMO_GSUP_SM_RP_MMS_IE		('45'O)
 } with { variant "FIELDLENGTH(8)" };
 
 type enumerated GSUP_MessageType {
@@ -75,7 +83,15 @@
 
 	OSMO_GSUP_MSGT_PROC_SS_REQUEST		('00100000'B),
 	OSMO_GSUP_MSGT_PROC_SS_ERROR		('00100001'B),
-	OSMO_GSUP_MSGT_PROC_SS_RESULT		('00100010'B)
+	OSMO_GSUP_MSGT_PROC_SS_RESULT		('00100010'B),
+
+	OSMO_GSUP_MSGT_MO_FORWARD_SM_REQUEST	('00100100'B),
+	OSMO_GSUP_MSGT_MO_FORWARD_SM_ERROR	('00100101'B),
+	OSMO_GSUP_MSGT_MO_FORWARD_SM_RESULT	('00100110'B),
+
+	OSMO_GSUP_MSGT_MT_FORWARD_SM_REQUEST	('00101000'B),
+	OSMO_GSUP_MSGT_MT_FORWARD_SM_ERROR	('00101001'B),
+	OSMO_GSUP_MSGT_MT_FORWARD_SM_RESULT	('00101010'B)
 } with { variant "FIELDLENGTH(8)" };
 
 type enumerated GSUP_CancelType {
@@ -128,6 +144,12 @@
 				 session_state, tag = OSMO_GSUP_SESSION_STATE_IE;
 				 session_id, tag = OSMO_GSUP_SESSION_ID_IE;
 				 ss_info, tag = OSMO_GSUP_SS_INFO_IE;
+				 sm_rp_mr, tag = OSMO_GSUP_SM_RP_MR_IE;
+				 sm_rp_da, tag = OSMO_GSUP_SM_RP_DA_IE;
+				 sm_rp_oa, tag = OSMO_GSUP_SM_RP_OA_IE;
+				 sm_rp_ui, tag = OSMO_GSUP_SM_RP_UI_IE;
+				 sm_rp_cause, tag = OSMO_GSUP_SM_RP_CAUSE_IE;
+				 sm_rp_mms, tag = OSMO_GSUP_SM_RP_MMS_IE;
 			)"
 };
 
@@ -161,7 +183,14 @@
 	GSUP_SessionState	session_state,
 	OCT4			session_id,
 	/* Supplementary Services */
-	octetstring		ss_info
+	octetstring		ss_info,
+	/* Short Message Service */
+	OCT1			sm_rp_mr,
+	GSUP_SM_RP_DA		sm_rp_da,
+	GSUP_SM_RP_OA		sm_rp_oa,
+	octetstring		sm_rp_ui,
+	OCT1			sm_rp_cause,
+	OCT1			sm_rp_mms
 };
 
 type record GSUP_PDU {
@@ -593,6 +622,235 @@
 	}
 }
 
+template (value) GSUP_IE ts_GSUP_IE_SM_RP_MR(OCT1 ref) := {
+	tag := OSMO_GSUP_SM_RP_MR_IE,
+	len := 0, /* overwritten */
+	val := {
+		sm_rp_mr := ref
+	}
+}
+template GSUP_IE tr_GSUP_IE_SM_RP_MR(template OCT1 ref) := {
+	tag := OSMO_GSUP_SM_RP_MR_IE,
+	len := ?,
+	val := {
+		sm_rp_mr := ref
+	}
+}
+
+template (value) GSUP_IE ts_GSUP_IE_SM_RP_CAUSE(OCT1 cause) := {
+	tag := OSMO_GSUP_SM_RP_CAUSE_IE,
+	len := 0, /* overwritten */
+	val := {
+		sm_rp_cause := cause
+	}
+}
+template GSUP_IE tr_GSUP_IE_SM_RP_CAUSE(template OCT1 cause) := {
+	tag := OSMO_GSUP_SM_RP_CAUSE_IE,
+	len := ?,
+	val := {
+		sm_rp_cause := cause
+	}
+}
+
+template (value) GSUP_IE ts_GSUP_IE_SM_RP_MMS(OCT1 mms) := {
+	tag := OSMO_GSUP_SM_RP_MMS_IE,
+	len := 0, /* overwritten */
+	val := {
+		sm_rp_mms := mms
+	}
+}
+template GSUP_IE tr_GSUP_IE_SM_RP_MMS(template OCT1 mms) := {
+	tag := OSMO_GSUP_SM_RP_MMS_IE,
+	len := ?,
+	val := {
+		sm_rp_mms := mms
+	}
+}
+
+/* Possible identity types for SM-RP-{OA|DA} IEs */
+type enumerated GSUP_SM_RP_ODA_IdType {
+	OSMO_GSUP_SM_RP_ODA_ID_NONE		('00'O),
+	OSMO_GSUP_SM_RP_ODA_ID_IMSI		('01'O),
+	OSMO_GSUP_SM_RP_ODA_ID_MSISDN		('02'O),
+	OSMO_GSUP_SM_RP_ODA_ID_SMSC_ADDR	('03'O),
+	/* Special value for noSM-RP-DA and noSM-RP-OA */
+	OSMO_GSUP_SM_RP_ODA_ID_NULL		('FF'O)
+} with { variant "FIELDLENGTH(8)" };
+
+/**
+ * SM-RP-DA represents the SM Destination Address, see 7.6.8.1.
+ * It can be either of the following:
+ *  - IMSI
+ *  - LMSI (not implemented)
+ *  - MSISDN
+ *  - roaming number (not implemented)
+ *  - service centre address
+ */
+type union GSUP_SM_RP_DA_ID {
+	hexstring	imsi,
+	hexstring	msisdn,
+	hexstring	smsc_addr
+};
+
+type record GSUP_SM_RP_DA {
+	GSUP_SM_RP_ODA_IdType	id_type,
+	uint8_t			id_len,
+	GSUP_SM_RP_DA_ID	id_enc optional
+} with { variant (id_len) "LENGTHTO(id_enc)"
+	 variant (id_enc) "CROSSTAG(
+		imsi, id_type = OSMO_GSUP_SM_RP_ODA_ID_IMSI;
+		msisdn, id_type = OSMO_GSUP_SM_RP_ODA_ID_MSISDN;
+		smsc_addr, id_type = OSMO_GSUP_SM_RP_ODA_ID_SMSC_ADDR;
+		/* FIXME: how to handle noSM-RP-DA? */
+	)"
+};
+
+template (value) GSUP_SM_RP_DA ts_GSUP_SM_RP_DA_IMSI(hexstring imsi) := {
+	id_type := OSMO_GSUP_SM_RP_ODA_ID_IMSI,
+	id_len := 0, /* overwritten */
+	id_enc := { imsi := imsi }
+}
+template GSUP_SM_RP_DA tr_GSUP_SM_RP_DA_IMSI(template hexstring imsi) := {
+	id_type := OSMO_GSUP_SM_RP_ODA_ID_IMSI,
+	id_len := ?,
+	id_enc := { imsi := imsi }
+}
+
+template (value) GSUP_SM_RP_DA ts_GSUP_SM_RP_DA_MSISDN(hexstring msisdn) := {
+	id_type := OSMO_GSUP_SM_RP_ODA_ID_MSISDN,
+	id_len := 0, /* overwritten */
+	id_enc := { msisdn := msisdn }
+}
+template GSUP_SM_RP_DA tr_GSUP_SM_RP_DA_MSISDN(template hexstring msisdn) := {
+	id_type := OSMO_GSUP_SM_RP_ODA_ID_MSISDN,
+	id_len := ?,
+	id_enc := { msisdn := msisdn }
+}
+
+template (value) GSUP_SM_RP_DA ts_GSUP_SM_RP_DA_SMSC_ADDR(hexstring smsc_addr) := {
+	id_type := OSMO_GSUP_SM_RP_ODA_ID_SMSC_ADDR,
+	id_len := 0, /* overwritten */
+	id_enc := { smsc_addr := smsc_addr }
+}
+template GSUP_SM_RP_DA tr_GSUP_SM_RP_DA_SMSC_ADDR(template hexstring smsc_addr) := {
+	id_type := OSMO_GSUP_SM_RP_ODA_ID_SMSC_ADDR,
+	id_len := ?,
+	id_enc := { smsc_addr := smsc_addr }
+}
+
+template (value) GSUP_SM_RP_DA ts_GSUP_SM_RP_DA_NULL := {
+	id_type := OSMO_GSUP_SM_RP_ODA_ID_NULL,
+	id_len := 0, /* overwritten */
+	id_enc := omit
+}
+template GSUP_SM_RP_DA tr_GSUP_SM_RP_DA_NULL := {
+	id_type := OSMO_GSUP_SM_RP_ODA_ID_NULL,
+	id_len := ?,
+	id_enc := omit
+}
+
+template (value) GSUP_IE ts_GSUP_IE_SM_RP_DA(GSUP_SM_RP_DA val) := {
+	tag := OSMO_GSUP_SM_RP_DA_IE,
+	len := 0, /* overwritten */
+	val := {
+		sm_rp_da := val
+	}
+}
+template GSUP_IE tr_GSUP_IE_SM_RP_DA(template GSUP_SM_RP_DA val) := {
+	tag := OSMO_GSUP_SM_RP_DA_IE,
+	len := ?,
+	val := {
+		sm_rp_da := val
+	}
+}
+
+/**
+ * SM-RP-OA represents the SM Originating Address, see 7.6.8.2.
+ * It can be either of the following:
+ *  - MSISDN
+ *  - service centre address
+ */
+type union GSUP_SM_RP_OA_ID {
+	hexstring	msisdn,
+	hexstring	smsc_addr
+};
+
+type record GSUP_SM_RP_OA {
+	GSUP_SM_RP_ODA_IdType	id_type,
+	uint8_t			id_len,
+	GSUP_SM_RP_OA_ID	id_enc optional
+} with { variant (id_len) "LENGTHTO(id_enc)"
+	 variant (id_enc) "CROSSTAG(
+		msisdn, id_type = OSMO_GSUP_SM_RP_ODA_ID_MSISDN;
+		smsc_addr, id_type = OSMO_GSUP_SM_RP_ODA_ID_SMSC_ADDR;
+		/* FIXME: how to handle noSM-RP-OA? */
+	)"
+};
+
+template (value) GSUP_SM_RP_OA ts_GSUP_SM_RP_OA_MSISDN(hexstring msisdn) := {
+	id_type := OSMO_GSUP_SM_RP_ODA_ID_MSISDN,
+	id_len := 0, /* overwritten */
+	id_enc := { msisdn := msisdn }
+}
+template GSUP_SM_RP_OA tr_GSUP_SM_RP_OA_MSISDN(template hexstring msisdn) := {
+	id_type := OSMO_GSUP_SM_RP_ODA_ID_MSISDN,
+	id_len := ?,
+	id_enc := { msisdn := msisdn }
+}
+
+template (value) GSUP_SM_RP_OA ts_GSUP_SM_RP_OA_SMSC_ADDR(hexstring smsc_addr) := {
+	id_type := OSMO_GSUP_SM_RP_ODA_ID_SMSC_ADDR,
+	id_len := 0, /* overwritten */
+	id_enc := { smsc_addr := smsc_addr }
+}
+template GSUP_SM_RP_OA tr_GSUP_SM_RP_OA_SMSC_ADDR(template hexstring smsc_addr) := {
+	id_type := OSMO_GSUP_SM_RP_ODA_ID_SMSC_ADDR,
+	id_len := ?,
+	id_enc := { smsc_addr := smsc_addr }
+}
+
+template (value) GSUP_SM_RP_OA ts_GSUP_SM_RP_OA_NULL := {
+	id_type := OSMO_GSUP_SM_RP_ODA_ID_NULL,
+	id_len := 0, /* overwritten */
+	id_enc := omit
+}
+template GSUP_SM_RP_OA tr_GSUP_SM_RP_OA_NULL := {
+	id_type := OSMO_GSUP_SM_RP_ODA_ID_NULL,
+	id_len := ?,
+	id_enc := omit
+}
+
+template (value) GSUP_IE ts_GSUP_IE_SM_RP_OA(GSUP_SM_RP_OA val) := {
+	tag := OSMO_GSUP_SM_RP_OA_IE,
+	len := 0, /* overwritten */
+	val := {
+		sm_rp_oa := val
+	}
+}
+template GSUP_IE tr_GSUP_IE_SM_RP_OA(template GSUP_SM_RP_OA val) := {
+	tag := OSMO_GSUP_SM_RP_OA_IE,
+	len := ?,
+	val := {
+		sm_rp_oa := val
+	}
+}
+
+/* SM-RP-UI represents the SM TPDU, see 7.6.8.4 */
+template (value) GSUP_IE ts_GSUP_IE_SM_RP_UI(octetstring val) := {
+	tag := OSMO_GSUP_SM_RP_UI_IE,
+	len := 0, /* overwritten */
+	val := {
+		sm_rp_ui := val
+	}
+}
+template GSUP_IE tr_GSUP_IE_SM_RP_UI(template octetstring val) := {
+	tag := OSMO_GSUP_SM_RP_UI_IE,
+	len := ?,
+	val := {
+		sm_rp_ui := val
+	}
+}
+
 template (value) GSUP_IE ts_GSUP_IE_SSInfo(octetstring ss) := {
 	tag := OSMO_GSUP_SS_INFO_IE,
 	len := 0, /* overwritten */
@@ -718,6 +976,178 @@
 	}
 );
 
+template (value) GSUP_PDU ts_GSUP_MO_FORWARD_SM_REQ(
+	hexstring imsi,
+	OCT1 sm_rp_mr, /* Message Reference, see GSM TS 04.11, 8.2.3 */
+	GSUP_SM_RP_DA sm_rp_da, /* Destination Address, see 7.6.8.1 */
+	GSUP_SM_RP_OA sm_rp_oa, /* Originating Address, see 7.6.8.2 */
+	octetstring sm_rp_ui /* SM TPDU, see 7.6.8.4 */
+) := ts_GSUP(
+	OSMO_GSUP_MSGT_MO_FORWARD_SM_REQUEST,
+	{
+		valueof(ts_GSUP_IE_IMSI(imsi)),
+		valueof(ts_GSUP_IE_SM_RP_MR(sm_rp_mr)),
+		valueof(ts_GSUP_IE_SM_RP_DA(sm_rp_da)),
+		valueof(ts_GSUP_IE_SM_RP_OA(sm_rp_oa)),
+		valueof(ts_GSUP_IE_SM_RP_UI(sm_rp_ui))
+	}
+);
+template GSUP_PDU tr_GSUP_MO_FORWARD_SM_REQ(
+	template hexstring imsi := ?,
+	template OCT1 sm_rp_mr := ?, /* Message Reference, see GSM TS 04.11, 8.2.3 */
+	template GSUP_SM_RP_DA sm_rp_da, /* Destination Address, see 7.6.8.1 */
+	template GSUP_SM_RP_OA sm_rp_oa, /* Originating Address, see 7.6.8.2 */
+	template octetstring sm_rp_ui /* SM TPDU, see 7.6.8.4 */
+) := tr_GSUP(
+	OSMO_GSUP_MSGT_MO_FORWARD_SM_REQUEST,
+	{
+		tr_GSUP_IE_IMSI(imsi),
+		tr_GSUP_IE_SM_RP_MR(sm_rp_mr),
+		tr_GSUP_IE_SM_RP_DA(sm_rp_da),
+		tr_GSUP_IE_SM_RP_OA(sm_rp_oa),
+		tr_GSUP_IE_SM_RP_UI(sm_rp_ui)
+	}
+);
+
+template (value) GSUP_PDU ts_GSUP_MO_FORWARD_SM_RES(
+	hexstring imsi,
+	OCT1 sm_rp_mr /* Message Reference, see GSM TS 04.11, 8.2.3 */
+) := ts_GSUP(
+	OSMO_GSUP_MSGT_MO_FORWARD_SM_RESULT,
+	{
+		valueof(ts_GSUP_IE_IMSI(imsi)),
+		valueof(ts_GSUP_IE_SM_RP_MR(sm_rp_mr))
+	}
+);
+template GSUP_PDU tr_GSUP_MO_FORWARD_SM_RES(
+	template hexstring imsi := ?,
+	template OCT1 sm_rp_mr := ? /* Message Reference, see GSM TS 04.11, 8.2.3 */
+) := tr_GSUP(
+	OSMO_GSUP_MSGT_MO_FORWARD_SM_RESULT,
+	{
+		tr_GSUP_IE_IMSI(imsi),
+		tr_GSUP_IE_SM_RP_MR(sm_rp_mr)
+	}
+);
+
+template (value) GSUP_PDU ts_GSUP_MO_FORWARD_SM_ERR(
+	hexstring imsi,
+	OCT1 sm_rp_mr, /* Message Reference, see GSM TS 04.11, 8.2.3 */
+	OCT1 sm_rp_cause /* RP-Cause value, see GSM TS 04.11, 8.2.5.4 */
+) := ts_GSUP(
+	OSMO_GSUP_MSGT_MO_FORWARD_SM_ERROR,
+	{
+		valueof(ts_GSUP_IE_IMSI(imsi)),
+		valueof(ts_GSUP_IE_SM_RP_MR(sm_rp_mr)),
+		valueof(ts_GSUP_IE_SM_RP_CAUSE(sm_rp_cause))
+	}
+);
+template GSUP_PDU tr_GSUP_MO_FORWARD_SM_ERR(
+	template hexstring imsi := ?,
+	template OCT1 sm_rp_mr := ?, /* Message Reference, see GSM TS 04.11, 8.2.3 */
+	template OCT1 sm_rp_cause := ? /* RP-Cause value, see GSM TS 04.11, 8.2.5.4 */
+) := tr_GSUP(
+	OSMO_GSUP_MSGT_MO_FORWARD_SM_ERROR,
+	{
+		tr_GSUP_IE_IMSI(imsi),
+		tr_GSUP_IE_SM_RP_MR(sm_rp_mr),
+		tr_GSUP_IE_SM_RP_CAUSE(sm_rp_cause)
+	}
+);
+
+template (value) GSUP_PDU ts_GSUP_MT_FORWARD_SM_REQ(
+	hexstring imsi,
+	OCT1 sm_rp_mr, /* Message Reference, see GSM TS 04.11, 8.2.3 */
+	GSUP_SM_RP_DA sm_rp_da, /* Destination Address, see 7.6.8.1 */
+	GSUP_SM_RP_OA sm_rp_oa, /* Originating Address, see 7.6.8.2 */
+	octetstring sm_rp_ui, /* SM TPDU, see 7.6.8.4 */
+	OCT1 sm_rp_mms /* MMS (More Messages to Send), see 7.6.8.7 */
+) := ts_GSUP(
+	OSMO_GSUP_MSGT_MT_FORWARD_SM_REQUEST,
+	{
+		/**
+		 * TODO: add MT-specific fields (and IEs):
+		 *  - smDeliveryTimer
+		 *  - smDeliveryStartTime
+		 */
+		valueof(ts_GSUP_IE_IMSI(imsi)),
+		valueof(ts_GSUP_IE_SM_RP_MR(sm_rp_mr)),
+		valueof(ts_GSUP_IE_SM_RP_DA(sm_rp_da)),
+		valueof(ts_GSUP_IE_SM_RP_OA(sm_rp_oa)),
+		valueof(ts_GSUP_IE_SM_RP_UI(sm_rp_ui)),
+		valueof(ts_GSUP_IE_SM_RP_MMS(sm_rp_mms))
+	}
+);
+template GSUP_PDU tr_GSUP_MT_FORWARD_SM_REQ(
+	template hexstring imsi := ?,
+	template OCT1 sm_rp_mr := ?, /* Message Reference, see GSM TS 04.11, 8.2.3 */
+	template GSUP_SM_RP_DA sm_rp_da, /* Destination Address, see 7.6.8.1 */
+	template GSUP_SM_RP_OA sm_rp_oa, /* Originating Address, see 7.6.8.2 */
+	template octetstring sm_rp_ui, /* SM TPDU, see 7.6.8.4 */
+	template OCT1 sm_rp_mms /* MMS (More Messages to Send), see 7.6.8.7 */
+) := tr_GSUP(
+	OSMO_GSUP_MSGT_MT_FORWARD_SM_REQUEST,
+	{
+		/**
+		 * TODO: add MT-specific fields (and IEs):
+		 *  - smDeliveryTimer
+		 *  - smDeliveryStartTime
+		 */
+		tr_GSUP_IE_IMSI(imsi),
+		tr_GSUP_IE_SM_RP_MR(sm_rp_mr),
+		tr_GSUP_IE_SM_RP_DA(sm_rp_da),
+		tr_GSUP_IE_SM_RP_OA(sm_rp_oa),
+		tr_GSUP_IE_SM_RP_UI(sm_rp_ui),
+		tr_GSUP_IE_SM_RP_MMS(sm_rp_mms)
+	}
+);
+
+template (value) GSUP_PDU ts_GSUP_MT_FORWARD_SM_RES(
+	hexstring imsi,
+	OCT1 sm_rp_mr /* Message Reference, see GSM TS 04.11, 8.2.3 */
+) := ts_GSUP(
+	OSMO_GSUP_MSGT_MT_FORWARD_SM_RESULT,
+	{
+		valueof(ts_GSUP_IE_IMSI(imsi)),
+		valueof(ts_GSUP_IE_SM_RP_MR(sm_rp_mr))
+	}
+);
+template GSUP_PDU tr_GSUP_MT_FORWARD_SM_RES(
+	template hexstring imsi := ?,
+	template OCT1 sm_rp_mr := ? /* Message Reference, see GSM TS 04.11, 8.2.3 */
+) := tr_GSUP(
+	OSMO_GSUP_MSGT_MT_FORWARD_SM_RESULT,
+	{
+		tr_GSUP_IE_IMSI(imsi),
+		tr_GSUP_IE_SM_RP_MR(sm_rp_mr)
+	}
+);
+
+template (value) GSUP_PDU ts_GSUP_MT_FORWARD_SM_ERR(
+	hexstring imsi,
+	OCT1 sm_rp_mr, /* Message Reference, see GSM TS 04.11, 8.2.3 */
+	OCT1 sm_rp_cause /* RP-Cause value, see GSM TS 04.11, 8.2.5.4 */
+) := ts_GSUP(
+	OSMO_GSUP_MSGT_MT_FORWARD_SM_ERROR,
+	{
+		valueof(ts_GSUP_IE_IMSI(imsi)),
+		valueof(ts_GSUP_IE_SM_RP_MR(sm_rp_mr)),
+		valueof(ts_GSUP_IE_SM_RP_CAUSE(sm_rp_cause))
+	}
+);
+template GSUP_PDU tr_GSUP_MT_FORWARD_SM_ERR(
+	template hexstring imsi := ?,
+	template OCT1 sm_rp_mr := ?, /* Message Reference, see GSM TS 04.11, 8.2.3 */
+	template OCT1 sm_rp_cause := ? /* RP-Cause value, see GSM TS 04.11, 8.2.5.4 */
+) := tr_GSUP(
+	OSMO_GSUP_MSGT_MT_FORWARD_SM_ERROR,
+	{
+		tr_GSUP_IE_IMSI(imsi),
+		tr_GSUP_IE_SM_RP_MR(sm_rp_mr),
+		tr_GSUP_IE_SM_RP_CAUSE(sm_rp_cause)
+	}
+);
+
 function f_gsup_find_ie(GSUP_PDU msg, GSUP_IEI iei, out GSUP_IeValue ret) return boolean {
 	for (var integer i := 0; i < sizeof(msg.ies); i := i+1) {
 		if (msg.ies[i].tag == iei) {