Exports SMS over D-Bus and mis cleanups

index 9da81aa..b972120 100644
@@ -80,3 +80,31 @@ char *sim_string_to_utf8(const unsigned char *buffer, int length);
 
 unsigned char *utf8_to_sim_string(const char *utf,
 					int max_length, int *out_length);
+/*
+ * Build time consistency checks
+ *
+ * Stolen from the Linux kernel 2.6.35-rc; as most taken from the
+ * Linux kernel, this is licensed GPL v2 or newer.
+ */
+
+/* Force a compilation error if condition is true */
+#define BUILD_BUG_ON(condition) ((void)BUILD_BUG_ON_ZERO(condition))
+
+/* Force a compilation error if condition is constant and true */
+#define MAYBE_BUILD_BUG_ON(cond) ((void)sizeof(char[1 - 2 * !!(cond)]))
+
+/* Force a compilation error if a constant expression is not a power of 2 */
+#define BUILD_BUG_ON_NOT_POWER_OF_2(n)			\
+	BUILD_BUG_ON((n) == 0 || (((n) & ((n) - 1)) != 0))
+
+/* Force a compilation error if condition is true, but also produce a
+   result (of value 0 and type size_t), so the expression can be used
+   e.g. in a structure initializer (or where-ever else comma expressions
+   aren't permitted). */
+#define BUILD_BUG_ON_ZERO(e) (sizeof(struct { int:-!!(e); }))
+#define BUILD_BUG_ON_NULL(e) ((void *)sizeof(struct { int:-!!(e); }))
+
+/*
+ * End of code stolen from the Linux kernel 2.6.35-rc. From now, code
+ * is GPL v2 only.
+ */

index 66ef6f8..baa3eca 100644
@@ -18,6 +18,14 @@
  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  *
  */
+#ifndef __smsutil_h__
+#define __smsutil_h__
+
+#include <time.h>
+#include <glib/gtypes.h>
+#include <glib/gslist.h>
+#include <glib/gmessages.h>
+#include <glib/gchecksum.h>
 
 #define CBS_MAX_GSM_CHARS 93
 

@@ -539,3 +547,4 @@ GSList *cbs_optimize_ranges(GSList *ranges);
 gboolean cbs_topic_in_range(unsigned int topic, GSList *ranges);
 
 char *ussd_decode(int dcs, int len, const unsigned char *data);
+#endif /* #ifndef __smsutil_h__ */

index cac5835..b8451de 100644
@@ -98,11 +98,21 @@ ssize_t read_file(unsigned char *buffer, size_t len,
 	return r;
 }
 
+/* 
+ * Write a buffer to a file in a transactionally safe form
+ *
+ * Given a buffer, write it to a file named after
+ * @path_fmt+args. However, to make sure the file contents are
+ * consistent (ie: a crash right after opening or during write()
+ * doesn't leave a file half baked), the contents are written to a
+ * file with a temporary name and when closed, it is renamed to the
+ * specified name (@path_fmt+args).
+ */ 
 ssize_t write_file(const unsigned char *buffer, size_t len, mode_t mode,
 			const char *path_fmt, ...)
 {
 	va_list ap;
-	char *path;
+	char *tmp_path, *path;
 	ssize_t r;
 	int fd;
 

@@ -110,26 +120,36 @@ ssize_t write_file(const unsigned char *buffer, size_t len, mode_t mode,
 	path = g_strdup_vprintf(path_fmt, ap);
 	va_end(ap);
 
-	if (create_dirs(path, mode | S_IXUSR) != 0) {
-		g_free(path);
-		return -1;
-	}
+	tmp_path = g_strdup_printf("%s.XXXXXX.tmp", path);
 
-	fd = TFR(open(path, O_WRONLY | O_CREAT | O_TRUNC, mode));
-	if (fd == -1) {
-		g_free(path);
-		return -1;
-	}
+	r = -1;
+	if (create_dirs(path, mode | S_IXUSR) != 0)
+		goto error_create_dirs;
+	fd = TFR(g_mkstemp_full(tmp_path, O_WRONLY | O_CREAT | O_TRUNC, mode));
+	if (fd == -1)
+		goto error_mkstemp_full;
 
 	r = TFR(write(fd, buffer, len));
 
 	TFR(close(fd));
 
 	if (r != (ssize_t) len) {
-		unlink(path);
 		r = -1;
+		goto error_write;
 	}
 
+	/* Now that the file contents are written, rename to the real
+	 * file name; this way we are uniquely sure that the whole
+	 * thing is there. */
+	unlink(path);
+	/* conserve @r's value from 'write' */
+	if (link(tmp_path, path) == -1)
+		r = -1;
+error_write:
+	unlink(tmp_path);
+error_mkstemp_full:
+error_create_dirs:
+	g_free(tmp_path);		
 	g_free(path);
 	return r;
 }

index d8df2f2..b395cfa 100644
@@ -110,7 +110,9 @@ static gboolean parse_debug(const char *key, const char *value,
 static GOptionEntry options[] = {
 	{ "debug", 'd', G_OPTION_FLAG_OPTIONAL_ARG,
 				G_OPTION_ARG_CALLBACK, parse_debug,
-				"Specify debug options to enable", "DEBUG" },
+			   "Specify debug options to enable (see the "
+			   "man page for ofonod(8) for more information).",
+			   "DEBUG" },
 	{ "nodetach", 'n', G_OPTION_FLAG_REVERSE,
 				G_OPTION_ARG_NONE, &option_detach,
 				"Don't run as daemon in background" },

194 lines not on this page · raw message

86 lines not on this page · raw message

212 lines not on this page · raw message

index 96c5001..78fabf5 100644
@@ -2314,7 +2314,7 @@ static void sms_assembly_load(struct sms_assembly *assembly,
 				const struct dirent *dir)
 {
 	struct sms_address addr;
-	char straddr[25];
+	DECLARE_SMS_ADDR_STR(straddr);
 	guint16 ref;
 	guint8 max;
 	guint8 seq;

@@ -2391,7 +2391,7 @@ static gboolean sms_assembly_store(struct sms_assembly *assembly,
 {
 	unsigned char buf[177];
 	int len;
-	char straddr[25];
+	DECLARE_SMS_ADDR_STR(straddr);
 
 	if (!assembly->imsi)
 		return FALSE;

index 9f43c0b..1c272bc 100644
@@ -440,6 +440,9 @@ gboolean sms_decode_unpacked_stk_pdu(const unsigned char *pdu, int len,
 gboolean sms_encode(const struct sms *in, int *len, int *tpdu_len,
 			unsigned char *pdu);
 
+enum { SMS_ADDR_STR_SIZE = 25 };
+#define DECLARE_SMS_ADDR_STR(a) char a[SMS_ADDR_STR_SIZE]
+
 gboolean sms_decode_address_field(const unsigned char *pdu, int len,
 					int *offset, gboolean sc,
 					struct sms_address *out);

index 78fabf5..cdf28f9 100644
@@ -2293,8 +2293,8 @@ static gboolean sms_assembly_extract_address(const char *straddr,
 	return sms_decode_address_field(pdu, len, &offset, FALSE, out);
 }
 
-static gboolean sms_assembly_encode_address(const struct sms_address *in,
-						char *straddr)
+gboolean sms_assembly_encode_address(const struct sms_address *in,
+				     char *straddr)
 {
 	unsigned char pdu[12];
 	int offset = 0;

index 1c272bc..0d47385 100644
@@ -505,6 +505,8 @@ GSList *sms_assembly_add_fragment(struct sms_assembly *assembly,
 					const struct sms_address *addr,
 					guint16 ref, guint8 max, guint8 seq);
 void sms_assembly_expire(struct sms_assembly *assembly, time_t before);
+gboolean sms_assembly_encode_address(const struct sms_address *in,
+				     char *straddr);
 
 struct status_report_assembly *status_report_assembly_new(const char *imsi);
 void status_report_assembly_free(struct status_report_assembly *assembly);

index b5c0614..66a0be3 100644
@@ -55,7 +55,6 @@ struct ofono_sms {
 	DBusMessage *pending;
 	struct ofono_phone_number sca;
 	struct sms_assembly *assembly;
-	unsigned int next_msg_id;
 	guint ref;
 	GQueue *txq;
 	gint tx_source;

@@ -450,9 +449,13 @@ static DBusMessage *sms_send_message(DBusConnection *conn, DBusMessage *msg,
 	const char *to;
 	const char *text;
 	GSList *msg_list;
-	int ref_offset;
+	int ref_offset, ref;
 	struct tx_queue_entry *entry;
 	struct ofono_modem *modem;
+	struct sms_msg_id sms_msg_id;
+	DECLARE_SMS_MSG_ID_STRBUF(msg_id_str);
+	struct sms_address receiver;
+	DECLARE_SMS_ADDR_STR(receiver_str);
 
 	if (!dbus_message_get_args(msg, NULL, DBUS_TYPE_STRING, &to,
 					DBUS_TYPE_STRING, &text,

@@ -462,31 +465,40 @@ static DBusMessage *sms_send_message(DBusConnection *conn, DBusMessage *msg,
 	if (valid_phone_number_format(to) == FALSE)
 		return __ofono_error_invalid_format(msg);
 
+	/*
+	 * Instead of using the telephone number/address we got from
+	 * D-Bus, we do the reverse formatting, so we get something
+	 * that has been normalized--this is used later and we do it
+	 * here to simplify error handling.
+	 */
+	sms_address_from_string(&receiver, to);
+	if (sms_assembly_encode_address(&receiver, receiver_str)
+	    == FALSE)
+		return __ofono_error_failed(msg);
+
 	msg_list = sms_text_prepare(text, 0, TRUE, &ref_offset,
 					sms->use_delivery_reports);
 
 	if (!msg_list)
 		return __ofono_error_invalid_format(msg);
 
-	DBG("ref: %d, offset: %d", sms->ref, ref_offset);
+	sms_msg_id_init(&sms_msg_id);
+	sms_msg_id_hash(&sms_msg_id, text, strlen(text));
+	sms_msg_id_hash(&sms_msg_id, receiver_str, strlen(receiver_str));
+	sms_msg_id_hash(&sms_msg_id, NULL, 0);
+	sms_msg_id_memcpy(&ref, sizeof(ref), &sms_msg_id);
+	sms_msg_id_printf(&sms_msg_id, msg_id_str, sizeof(msg_id_str));
 
-	set_ref_and_to(msg_list, sms->ref, ref_offset, to);
+	set_ref_and_to(msg_list, ref, ref_offset, to);
 	entry = create_tx_queue_entry(msg_list);
-
-	sms_address_from_string(&entry->receiver, to);
+	ofono_debug("SMS: %p: ref %08x, offset %d, msg id: %s\n",
+		    entry, ref, ref_offset, msg_id_str);
+	entry->msg_id = ref;
+	entry->receiver = receiver;
 
 	g_slist_foreach(msg_list, (GFunc)g_free, NULL);
 	g_slist_free(msg_list);
-
-	if (ref_offset != 0) {
-		if (sms->ref == 65536)
-			sms->ref = 1;
-		else
-			sms->ref = sms->ref + 1;
-	}
-
 	entry->msg = dbus_message_ref(msg);
-	entry->msg_id = sms->next_msg_id++;
 	entry->status_report = sms->use_delivery_reports;
 
 	g_queue_push_tail(sms->txq, entry);

@@ -544,6 +556,9 @@ static void dispatch_text_message(struct ofono_sms *sms,
 	struct tm remote;
 	struct tm local;
 	const char *str = buf;
+	struct sms_msg_id sms_msg_id;
+	unsigned int id;
+	DECLARE_SMS_MSG_ID_STRBUF(msg_id_str);
 
 	if (!message)
 		return;

@@ -585,11 +600,18 @@ static void dispatch_text_message(struct ofono_sms *sms,
 
 	g_dbus_send_message(conn, signal);
 
-	if (cls != SMS_CLASS_0) {
-		__ofono_history_sms_received(modem, sms->next_msg_id, str,
+	sms_msg_id_init(&sms_msg_id);
+	sms_msg_id_hash(&sms_msg_id, message, strlen(message));
+	sms_msg_id_hash(&sms_msg_id, addr->address, strlen(addr->address));
+	/* FIXME: add RX time? */
+	sms_msg_id_hash(&sms_msg_id, NULL, 0);
+	sms_msg_id_memcpy(&id, sizeof(id), &sms_msg_id);
+	sms_msg_id_printf(&sms_msg_id, msg_id_str, sizeof(msg_id_str));
+	ofono_debug("SMS RX: msg id is %s\n", msg_id_str);
+
+	if (cls != SMS_CLASS_0)
+		__ofono_history_sms_received(modem, id, str,
 						&remote, &local, message);
-		sms->next_msg_id += 1;
-	}
 }
 
 static void sms_dispatch(struct ofono_sms *sms, GSList *sms_list)

@@ -972,8 +994,6 @@ static void sms_remove(struct ofono_atom *atom)
 
 	if (sms->settings) {
 		g_key_file_set_integer(sms->settings, SETTINGS_GROUP,
-					"NextMessageId", sms->next_msg_id);
-		g_key_file_set_integer(sms->settings, SETTINGS_GROUP,
 					"NextReference", sms->ref);
 		g_key_file_set_boolean(sms->settings, SETTINGS_GROUP,
 					"UseDeliveryReports",

@@ -1065,8 +1085,6 @@ static void sms_load_settings(struct ofono_sms *sms, const char *imsi)
 
 	sms->imsi = g_strdup(imsi);
 
-	sms->next_msg_id = g_key_file_get_integer(sms->settings, SETTINGS_GROUP,
-							"NextMessageId", NULL);
 	sms->ref = g_key_file_get_integer(sms->settings, SETTINGS_GROUP,
 							"NextReference", NULL);
 	sms->use_delivery_reports =

index 66a0be3..d4d08fa 100644
@@ -76,6 +76,7 @@ struct pending_pdu {
 	int pdu_len;
 };
 
+
 struct tx_queue_entry {
 	struct pending_pdu *pdus;
 	unsigned char num_pdus;

@@ -291,6 +292,25 @@ static DBusMessage *sms_set_property(DBusConnection *conn, DBusMessage *msg,
 	return __ofono_error_invalid_args(msg);
 }
 
+
+/*
+ * Destroy/release the contents of a 'struct tx_queue_entry'
+ *
+ * This *only* releases resources allocated *inside* @entry. The
+ * caller still has to explicitly free @entry (if needed) itself.
+ */
+static void tx_queue_entry_destroy(struct tx_queue_entry *entry)
+{
+	g_free(entry->pdus);
+}
+
+static void tx_queue_entry_destroy_free(gpointer _entry, gpointer unused)
+{
+	struct tx_queue_entry *entry = _entry;
+	tx_queue_entry_destroy(entry);
+	g_free(entry);
+}
+
 static void tx_finished(const struct ofono_error *error, int mr, void *data)
 {
 	struct ofono_sms *sms = data;

@@ -320,7 +340,7 @@ static void tx_finished(const struct ofono_error *error, int mr, void *data)
 					time(NULL),
 					OFONO_HISTORY_SMS_STATUS_SUBMIT_FAILED);
 
-		g_free(entry->pdus);
+		tx_queue_entry_destroy(entry);
 		g_free(entry);
 
 		if (g_queue_peek_head(sms->txq)) {

@@ -353,7 +373,7 @@ static void tx_finished(const struct ofono_error *error, int mr, void *data)
 					time(NULL),
 					OFONO_HISTORY_SMS_STATUS_SUBMITTED);
 
-	g_free(entry->pdus);
+	tx_queue_entry_destroy(entry);
 	g_free(entry);
 
 	if (g_queue_peek_head(sms->txq)) {

@@ -987,7 +1007,7 @@ static void sms_remove(struct ofono_atom *atom)
 	}
 
 	if (sms->txq) {
-		g_queue_foreach(sms->txq, (GFunc)g_free, NULL);
+		g_queue_foreach(sms->txq, tx_queue_entry_destroy_free, NULL);
 		g_queue_free(sms->txq);
 		sms->txq = NULL;
 	}

index d4d08fa..87ea926 100644
@@ -77,6 +77,9 @@ struct pending_pdu {
 };
 
 
+/*
+ * @name: Name for the SMS message object (used by D-Bus)
+ */
 struct tx_queue_entry {
 	struct pending_pdu *pdus;
 	unsigned char num_pdus;

@@ -86,6 +89,7 @@ struct tx_queue_entry {
 	DBusMessage *msg;
 	gboolean status_report;
 	struct sms_address receiver;
+	char *name;
 };
 
 static void set_sca(struct ofono_sms *sms,

@@ -302,6 +306,7 @@ static DBusMessage *sms_set_property(DBusConnection *conn, DBusMessage *msg,
 static void tx_queue_entry_destroy(struct tx_queue_entry *entry)
 {
 	g_free(entry->pdus);
+	g_free(entry->name);
 }
 
 static void tx_queue_entry_destroy_free(gpointer _entry, gpointer unused)

@@ -461,6 +466,9 @@ static struct tx_queue_entry *create_tx_queue_entry(GSList *msg_list)
  * is created by create_tx_queue_entry() and g_queue_push_tail()
  * appends that entry to the SMS transmit queue. Then the tx_next()
  * function is scheduled to run to process the queue.
+ *
+ * @sms is the main SMS driver struct, @entry and @msg_list represent
+ * the current message being processed.
  */
 static DBusMessage *sms_send_message(DBusConnection *conn, DBusMessage *msg,
 					void *data)

@@ -476,6 +484,7 @@ static DBusMessage *sms_send_message(DBusConnection *conn, DBusMessage *msg,
 	DECLARE_SMS_MSG_ID_STRBUF(msg_id_str);
 	struct sms_address receiver;
 	DECLARE_SMS_ADDR_STR(receiver_str);
+	const char *sms_path = __ofono_atom_get_path(sms->atom);
 
 	if (!dbus_message_get_args(msg, NULL, DBUS_TYPE_STRING, &to,
 					DBUS_TYPE_STRING, &text,

@@ -520,6 +529,9 @@ static DBusMessage *sms_send_message(DBusConnection *conn, DBusMessage *msg,
 	g_slist_free(msg_list);
 	entry->msg = dbus_message_ref(msg);
 	entry->status_report = sms->use_delivery_reports;
+	entry->name = g_strdup_printf(SMS_MSG_NAME_FMT, sms_path,
+				      msg_id_str, entry->num_pdus);
+	ofono_debug("sms/entry %p name %s\n", entry, entry->name);
 
 	g_queue_push_tail(sms->txq, entry);
 

index 0d47385..b87dffb 100644
@@ -634,4 +634,10 @@ void sms_msg_id_memcpy(void *, size_t, const struct sms_msg_id *);
 /* for unit testing only */
 gsize __sms_msg_id_hash_length(void);
 
+/*
+ * UNIQUE-ID_#PDUS -- note we use underscores as to generate a name
+ * suitable to be a D-Bus name.
+ */
+#define SMS_MSG_NAME_FMT "%s/%s_%i"
+
 #endif /* #ifndef __smsutil_h__ */

index 87ea926..0bdfc45 100644
@@ -50,6 +50,35 @@ static gboolean tx_next(gpointer user_data);
 
 static GSList *g_drivers = NULL;
 
+/*
+ * SMS TX message's state
+ *
+ * When a message is queued to be delivered, it will transition
+ * through a set of states.
+ *
+ * Allowed transition table (Allowed, Not-allowed) from left to right:
+ *
+ *          UNINITIALIZED     CANCELING  FAILED
+ *               | QUEUED DONE   | CANCELLED  EXPIRED
+ * UNINITIALIZED -    A     N    N    N    N    N
+ * QUEUED        N    -     A    A    N    A    N
+ * DONE          A    N     -    N    N    N    N
+ * CANCELING     N    N     N    -    A    A    A
+ * CANCELLED     A    N     N    N    -    N    N
+ * FAILED        A    N     N    N    N    -    N
+ * EXPIRED       A    N     N    N    N    N    -
+ */
+enum ofono_sms_tx_state {
+	OFONO_SMS_TX_ST_UNINITIALIZED,
+	OFONO_SMS_TX_ST_QUEUED,
+	OFONO_SMS_TX_ST_DONE,
+	OFONO_SMS_TX_ST_CANCELING,
+	OFONO_SMS_TX_ST_CANCELLED,
+	OFONO_SMS_TX_ST_FAILED,
+	OFONO_SMS_TX_ST_EXPIRED,
+	__OFONO_SMS_TX_ST_INVALID,
+};
+
 struct ofono_sms {
 	int flags;
 	DBusMessage *pending;

@@ -79,6 +108,7 @@ struct pending_pdu {
 
 /*
  * @name: Name for the SMS message object (used by D-Bus)
+ * @state: Current state of the (in-transit) SMS
  */
 struct tx_queue_entry {
 	struct pending_pdu *pdus;

@@ -90,6 +120,7 @@ struct tx_queue_entry {
 	gboolean status_report;
 	struct sms_address receiver;
 	char *name;
+	enum ofono_sms_tx_state state;
 };
 
 static void set_sca(struct ofono_sms *sms,

@@ -297,6 +328,77 @@ static DBusMessage *sms_set_property(DBusConnection *conn, DBusMessage *msg,
 }
 
 
+/* Check if a state transition is legal */
+static void ofono_sms_tx_state_check(const char *file, unsigned line,
+				     const struct tx_queue_entry *entry,
+				     enum ofono_sms_tx_state state_old,
+				     enum ofono_sms_tx_state state_new,
+				     unsigned states_allowed_bm)
+{
+	if (((1 << state_new) & states_allowed_bm) == 0)
+		ofono_warn("%s:%d: SW BUG? Forbidden state change "
+			   "%p %u -> %u\n",
+			   file, line, entry, state_old, state_new);
+}
+
+
+/*
+ * Set a pending SMS's state
+ *
+ * This is just syntatic sugar that validates that the transition is
+ * correct and warns out otherwise. The transition table is defined in
+ * the doc block for 'enum ofono_sms_tx_state'.
+ *
+ * In case of inconsistency, we just warn and press forward.
+ */
+#define ofono_sms_tx_state_set(entry, new_state) \
+	__ofono_sms_tx_state_set(entry, new_state, __FILE__, __LINE__)
+
+static void __ofono_sms_tx_state_set(struct tx_queue_entry *entry,
+				     enum ofono_sms_tx_state state_new,
+				     const char *file, unsigned line)
+{
+	enum ofono_sms_tx_state state_old = entry->state;
+
+	switch (state_old) {
+	case OFONO_SMS_TX_ST_UNINITIALIZED:
+		ofono_sms_tx_state_check(
+			file, line, entry, state_old, state_new,
+			1 << OFONO_SMS_TX_ST_QUEUED);
+		break;
+	case OFONO_SMS_TX_ST_QUEUED:
+		ofono_sms_tx_state_check(
+			file, line, entry, state_old, state_new,
+			1 << OFONO_SMS_TX_ST_DONE
+			| 1 << OFONO_SMS_TX_ST_CANCELING
+			| 1 << OFONO_SMS_TX_ST_FAILED);
+		break;
+	case OFONO_SMS_TX_ST_CANCELING:
+		ofono_sms_tx_state_check(
+			file, line, entry, state_old, state_new,
+			1 << OFONO_SMS_TX_ST_CANCELLED
+			| 1 << OFONO_SMS_TX_ST_FAILED
+			| 1 << OFONO_SMS_TX_ST_EXPIRED);
+		break;
+	case OFONO_SMS_TX_ST_DONE:
+	case OFONO_SMS_TX_ST_CANCELLED:
+	case OFONO_SMS_TX_ST_FAILED:
+	case OFONO_SMS_TX_ST_EXPIRED:
+		ofono_sms_tx_state_check(
+			file, line, entry, state_old, state_new,
+			1 << OFONO_SMS_TX_ST_UNINITIALIZED);
+		break;
+	case __OFONO_SMS_TX_ST_INVALID:
+	default:
+		ofono_warn("%s:%d: SW BUG? Bad state change %p %u -> %u\n",
+			   file, line, entry, state_old, state_new);
+	}
+	ofono_debug("%s:%d: SMS state change: %p %u -> %u\n",
+		    file, line, entry, state_old, state_new);
+	entry->state = state_new;
+}
+
+
 /*
  * Destroy/release the contents of a 'struct tx_queue_entry'
  *

@@ -307,6 +409,7 @@ static void tx_queue_entry_destroy(struct tx_queue_entry *entry)
 {
 	g_free(entry->pdus);
 	g_free(entry->name);
+	entry->state = __OFONO_SMS_TX_ST_INVALID;
 }
 
 static void tx_queue_entry_destroy_free(gpointer _entry, gpointer unused)

@@ -337,6 +440,7 @@ static void tx_finished(const struct ofono_error *error, int mr, void *data)
 
 		DBG("Max retries reached, giving up");
 
+		ofono_sms_tx_state_set(entry, OFONO_SMS_TX_ST_CANCELING);
 		entry = g_queue_pop_head(sms->txq);
 		__ofono_dbus_pending_reply(&entry->msg,
 					__ofono_error_failed(entry->msg));

@@ -345,6 +449,7 @@ static void tx_finished(const struct ofono_error *error, int mr, void *data)
 					time(NULL),
 					OFONO_HISTORY_SMS_STATUS_SUBMIT_FAILED);
 
+		ofono_sms_tx_state_set(entry, OFONO_SMS_TX_ST_FAILED);
 		tx_queue_entry_destroy(entry);
 		g_free(entry);
 

@@ -378,6 +483,7 @@ static void tx_finished(const struct ofono_error *error, int mr, void *data)
 					time(NULL),
 					OFONO_HISTORY_SMS_STATUS_SUBMITTED);
 
+	ofono_sms_tx_state_set(entry, OFONO_SMS_TX_ST_DONE);
 	tx_queue_entry_destroy(entry);
 	g_free(entry);
 

@@ -534,6 +640,7 @@ static DBusMessage *sms_send_message(DBusConnection *conn, DBusMessage *msg,
 	ofono_debug("sms/entry %p name %s\n", entry, entry->name);
 
 	g_queue_push_tail(sms->txq, entry);
+	ofono_sms_tx_state_set(entry, OFONO_SMS_TX_ST_QUEUED);
 
 	modem = __ofono_atom_get_modem(sms->atom);
 	__ofono_history_sms_send_pending(modem, entry->msg_id, to,

index 0bdfc45..49b9c4c 100644
@@ -41,6 +41,10 @@
 
 #define SMS_MANAGER_FLAG_CACHED 0x1
 
+/* D-Bus interface name for SMS messages (not for the manager!) */
+static
+const char SMS_MSG_INTERFACE[] = "org.ofono.SMSMessage";
+
 #define SETTINGS_STORE "sms"
 #define SETTINGS_GROUP "Settings"
 

@@ -108,6 +112,7 @@ struct pending_pdu {
 
 /*
  * @name: Name for the SMS message object (used by D-Bus)
+ * @dbus_path: D-Bus path for this object
  * @state: Current state of the (in-transit) SMS
  */
 struct tx_queue_entry {

@@ -120,6 +125,7 @@ struct tx_queue_entry {
 	gboolean status_report;
 	struct sms_address receiver;
 	char *name;
+	char *dbus_path;
 	enum ofono_sms_tx_state state;
 };
 

@@ -400,6 +406,55 @@ static void __ofono_sms_tx_state_set(struct tx_queue_entry *entry,
 
 
 /*
+ * D-Bus SMS Message interface
+ *
+ * NOTE: the sms_msg_{methods,signals} tables should be const, but
+ * then g_dbus_register_interface() type warns.
+ */
+
+static
+GDBusMethodTable sms_msg_methods[] = {
+	{ }
+};
+
+
+static
+GDBusSignalTable sms_msg_signals[] = {
+	{ "PropertyChanged",	"sv"		},
+	{ }
+};
+
+
+static
+void sms_msg_register(struct tx_queue_entry *sms_msg)
+{
+	g_assert(sms_msg->name != NULL);
+	sms_msg->dbus_path = g_strdup(sms_msg->name);
+	if (!g_dbus_register_interface(ofono_dbus_get_connection(),
+				       sms_msg->dbus_path, SMS_MSG_INTERFACE,
+				       sms_msg_methods, sms_msg_signals,
+				       NULL, sms_msg, NULL)) {
+		ofono_error("%s: Could not create %s interface",
+			    sms_msg->dbus_path, SMS_MSG_INTERFACE);
+		g_free(sms_msg->dbus_path);
+	}
+	ofono_debug("%s: %d: sms %p: MSG registered @ %s",
+		    __FILE__, __LINE__, sms_msg, sms_msg->dbus_path);
+}
+
+
+static
+void sms_msg_unregister(struct tx_queue_entry *sms_msg)
+{
+	g_dbus_unregister_interface(ofono_dbus_get_connection(),
+				    sms_msg->dbus_path, SMS_MSG_INTERFACE);
+	g_free(sms_msg->dbus_path);
+	ofono_debug("%s: %d: sms %p: MSG unregistered",
+		    __FILE__, __LINE__, sms_msg);
+}
+
+
+/*
  * Destroy/release the contents of a 'struct tx_queue_entry'
  *
  * This *only* releases resources allocated *inside* @entry. The

@@ -407,6 +462,7 @@ static void __ofono_sms_tx_state_set(struct tx_queue_entry *entry,
  */
 static void tx_queue_entry_destroy(struct tx_queue_entry *entry)
 {
+	sms_msg_unregister(entry);
 	g_free(entry->pdus);
 	g_free(entry->name);
 	entry->state = __OFONO_SMS_TX_ST_INVALID;

@@ -556,7 +612,6 @@ static struct tx_queue_entry *create_tx_queue_entry(GSList *msg_list)
 		DBG("pdu_len: %d, tpdu_len: %d",
 				pdu->pdu_len, pdu->tpdu_len);
 	}
-
 	return entry;
 }
 

@@ -638,6 +693,7 @@ static DBusMessage *sms_send_message(DBusConnection *conn, DBusMessage *msg,
 	entry->name = g_strdup_printf(SMS_MSG_NAME_FMT, sms_path,
 				      msg_id_str, entry->num_pdus);
 	ofono_debug("sms/entry %p name %s\n", entry, entry->name);
+	sms_msg_register(entry);
 
 	g_queue_push_tail(sms->txq, entry);
 	ofono_sms_tx_state_set(entry, OFONO_SMS_TX_ST_QUEUED);

index 1b35fa9..27a3d64 100644
@@ -532,8 +532,15 @@ GDBusSignalTable sms_msg_signals[] = {
 };
 
 
+/**
+ *
+ * @returns 0 if ok, 0 on error
+ *
+ * On success, sms_msg->dbus_path is non-NULL; this is needed as the
+ * cleanup path on error are not easy to break up.
+ */
 static
-void sms_msg_register(struct tx_queue_entry *sms_msg)
+int sms_msg_register(struct tx_queue_entry *sms_msg)
 {
 	g_assert(sms_msg->name != NULL);
 	sms_msg->dbus_path = g_strdup(sms_msg->name);

@@ -544,20 +551,26 @@ void sms_msg_register(struct tx_queue_entry *sms_msg)
 		ofono_error("%s: Could not create %s interface",
 			    sms_msg->dbus_path, SMS_MSG_INTERFACE);
 		g_free(sms_msg->dbus_path);
+		sms_msg->dbus_path = NULL;
+		return 1;
+	} else {
+		ofono_debug("%s: %d: sms %p @ %s: MSG registered",
+			    __FILE__, __LINE__, sms_msg, sms_msg->dbus_path);
+		return 0;
 	}
-	ofono_debug("%s: %d: sms %p: MSG registered @ %s",
-		    __FILE__, __LINE__, sms_msg, sms_msg->dbus_path);
 }
 
 
 static
 void sms_msg_unregister(struct tx_queue_entry *sms_msg)
 {
+	if (sms_msg->dbus_path == NULL)
+		return;
+	ofono_debug("%s: %d: sms %p @ %s: MSG unregistered",
+		    __FILE__, __LINE__, sms_msg, sms_msg->dbus_path);
 	g_dbus_unregister_interface(ofono_dbus_get_connection(),
 				    sms_msg->dbus_path, SMS_MSG_INTERFACE);
 	g_free(sms_msg->dbus_path);
-	ofono_debug("%s: %d: sms %p: MSG unregistered",
-		    __FILE__, __LINE__, sms_msg);
 }
 
 

@@ -801,7 +814,10 @@ struct tx_queue_entry *sms_msg_send(
 	entry->name = g_strdup_printf(SMS_MSG_NAME_FMT, sms_path,
 				      msg_id_str, entry->num_pdus);
 	ofono_debug("sms/entry %p name %s\n", entry, entry->name);
-	sms_msg_register(entry);
+	if (sms_msg_register(entry)) {
+		tx_queue_entry_destroy_free(entry, NULL);
+		return NULL;
+	}
 
 	g_queue_push_tail(sms->txq, entry);
 	ofono_sms_tx_state_set(entry, OFONO_SMS_TX_ST_QUEUED);

index 49b9c4c..0182ac8 100644
@@ -466,6 +466,10 @@ static void tx_queue_entry_destroy(struct tx_queue_entry *entry)
 	g_free(entry->pdus);
 	g_free(entry->name);
 	entry->state = __OFONO_SMS_TX_ST_INVALID;
+	if (entry->msg) {
+		dbus_message_unref(entry->msg);
+		entry->msg = NULL;
+	}
 }
 
 static void tx_queue_entry_destroy_free(gpointer _entry, gpointer unused)

@@ -615,8 +619,9 @@ static struct tx_queue_entry *create_tx_queue_entry(GSList *msg_list)
 	return entry;
 }
 
+
 /*
- * Pre-process a SMS text message and deliver it [D-Bus SendMessage()]
+ * Pre-process a SMS text message and deliver it
  *
  * @conn: D-Bus connection
  * @msg: message data (telephone number and text)

@@ -631,12 +636,10 @@ static struct tx_queue_entry *create_tx_queue_entry(GSList *msg_list)
  * @sms is the main SMS driver struct, @entry and @msg_list represent
  * the current message being processed.
  */
-static DBusMessage *sms_send_message(DBusConnection *conn, DBusMessage *msg,
-					void *data)
+struct tx_queue_entry *sms_msg_send(
+	struct ofono_sms *sms, const char *to, const char *text,
+	enum sms_msg_send_flags flags)
 {
-	struct ofono_sms *sms = data;
-	const char *to;
-	const char *text;
 	GSList *msg_list;
 	int ref_offset, ref;
 	struct tx_queue_entry *entry;

@@ -647,13 +650,8 @@ static DBusMessage *sms_send_message(DBusConnection *conn, DBusMessage *msg,
 	DECLARE_SMS_ADDR_STR(receiver_str);
 	const char *sms_path = __ofono_atom_get_path(sms->atom);
 
-	if (!dbus_message_get_args(msg, NULL, DBUS_TYPE_STRING, &to,
-					DBUS_TYPE_STRING, &text,
-					DBUS_TYPE_INVALID))
-		return __ofono_error_invalid_args(msg);
-
 	if (valid_phone_number_format(to) == FALSE)
-		return __ofono_error_invalid_format(msg);
+		return NULL;
 
 	/*
 	 * Instead of using the telephone number/address we got from

@@ -664,13 +662,13 @@ static DBusMessage *sms_send_message(DBusConnection *conn, DBusMessage *msg,
 	sms_address_from_string(&receiver, to);
 	if (sms_assembly_encode_address(&receiver, receiver_str)
 	    == FALSE)
-		return __ofono_error_failed(msg);
+		return NULL;
 
 	msg_list = sms_text_prepare(text, 0, TRUE, &ref_offset,
 					sms->use_delivery_reports);
 
 	if (!msg_list)
-		return __ofono_error_invalid_format(msg);
+		return NULL;
 
 	sms_msg_id_init(&sms_msg_id);
 	sms_msg_id_hash(&sms_msg_id, text, strlen(text));

@@ -688,7 +686,6 @@ static DBusMessage *sms_send_message(DBusConnection *conn, DBusMessage *msg,
 
 	g_slist_foreach(msg_list, (GFunc)g_free, NULL);
 	g_slist_free(msg_list);
-	entry->msg = dbus_message_ref(msg);
 	entry->status_report = sms->use_delivery_reports;
 	entry->name = g_strdup_printf(SMS_MSG_NAME_FMT, sms_path,
 				      msg_id_str, entry->num_pdus);

@@ -699,21 +696,54 @@ static DBusMessage *sms_send_message(DBusConnection *conn, DBusMessage *msg,
 	ofono_sms_tx_state_set(entry, OFONO_SMS_TX_ST_QUEUED);
 
 	modem = __ofono_atom_get_modem(sms->atom);
-	__ofono_history_sms_send_pending(modem, entry->msg_id, to,
-						time(NULL), text);
+	if (flags & SMS_MSG_SEND_HISTORY)
+		__ofono_history_sms_send_pending(modem, entry->msg_id, to,
+						 time(NULL), text);
 
 	if (g_queue_get_length(sms->txq) == 1)
 		sms->tx_source = g_timeout_add(0, tx_next, sms);
 
+	return entry;
+}
+
+
+/*
+ * D-Bus: Send a SMS text message
+ *
+ * @conn: D-Bus connection
+ * @msg: message data (telephone number and text)
+ * @data: SMS object to use for transmision
+ *
+ * Unwraps the arguments and sends the request to sms_msg_send()
+ */
+static DBusMessage *dbus_SendMessage(DBusConnection *conn, DBusMessage *msg,
+				     void *data)
+{
+	struct ofono_sms *sms = data;
+	const char *to;
+	const char *text;
+	struct tx_queue_entry *sms_msg;
+
+	if (!dbus_message_get_args(msg, NULL, DBUS_TYPE_STRING, &to,
+					DBUS_TYPE_STRING, &text,
+					DBUS_TYPE_INVALID))
+		return __ofono_error_invalid_args(msg);
+
+	sms_msg = sms_msg_send(sms, to, text, SMS_MSG_SEND_HISTORY);
+	if (sms_msg == NULL)
+		return __ofono_error_invalid_format(msg);
+	/* Unreferenced upon tx_queue_entry_destroy() */
+	sms_msg->msg = dbus_message_ref(msg);
 	return NULL;
 }
 
+
 static GDBusMethodTable sms_manager_methods[] = {
 	{ "GetProperties",	"",	"a{sv}",	sms_get_properties,
 							G_DBUS_METHOD_FLAG_ASYNC },
 	{ "SetProperty",	"sv",	"",		sms_set_property,
 							G_DBUS_METHOD_FLAG_ASYNC },
-	{ "SendMessage",	"ss",	"",		sms_send_message,
+	{ "SendMessage",	"ss",	"",		dbus_SendMessage,
 							G_DBUS_METHOD_FLAG_ASYNC },
 	{ }
 };

index b87dffb..40df71f 100644
@@ -217,6 +217,12 @@ enum cbs_geo_scope {
 	CBS_GEO_SCOPE_CELL_NORMAL
 };
 
+/* Flags to sms_msg_send() */
+enum sms_msg_send_flags {
+	/* Record/dont this message to the history database */
+	SMS_MSG_SEND_HISTORY = 0x01,
+};
+
 struct sms_address {
 	enum sms_number_type number_type;
 	enum sms_numbering_plan numbering_plan;

index 0182ac8..97c7429 100644
@@ -62,19 +62,21 @@ static GSList *g_drivers = NULL;
  *
  * Allowed transition table (Allowed, Not-allowed) from left to right:
  *
- *          UNINITIALIZED     CANCELING  FAILED
- *               | QUEUED DONE   | CANCELLED  EXPIRED
- * UNINITIALIZED -    A     N    N    N    N    N
- * QUEUED        N    -     A    A    N    A    N
- * DONE          A    N     -    N    N    N    N
- * CANCELING     N    N     N    -    A    A    A
- * CANCELLED     A    N     N    N    -    N    N
- * FAILED        A    N     N    N    N    -    N
- * EXPIRED       A    N     N    N    N    N    -
+ *          UNINITIALIZED         CANCELING  FAILED
+ *               | QUEUED WFA DONE   | CANCELLED  EXPIRED
+ * UNINITIALIZED -    A    N    N    N    N    N    N
+ * QUEUED        N    -    A    A    A    N    A    N
+ * WFA           N    N    -    A    A    N    A    A
+ * DONE          A    N    N    -    N    N    N    N
+ * CANCELING     N    N    N    N    -    A    A    A
+ * CANCELLED     A    N    N    N    N    -    N    N
+ * FAILED        A    N    N    N    N    N    -    N
+ * EXPIRED       A    N    N    N    N    N    N    -
  */
 enum ofono_sms_tx_state {
 	OFONO_SMS_TX_ST_UNINITIALIZED,
 	OFONO_SMS_TX_ST_QUEUED,
+	OFONO_SMS_TX_ST_WFA,
 	OFONO_SMS_TX_ST_DONE,
 	OFONO_SMS_TX_ST_CANCELING,
 	OFONO_SMS_TX_ST_CANCELLED,

@@ -83,6 +85,12 @@ enum ofono_sms_tx_state {
 	__OFONO_SMS_TX_ST_INVALID,
 };
 
+
+/**
+ * @wfaq: Waiting-For-Acknoledgement queue; messages in this queue
+ *     have been delivered but are waiting to be acknoledged by the
+ *     network.
+ */
 struct ofono_sms {
 	int flags;
 	DBusMessage *pending;

@@ -90,6 +98,7 @@ struct ofono_sms {
 	struct sms_assembly *assembly;
 	guint ref;
 	GQueue *txq;
+	GQueue *tx_wfaq;
 	gint tx_source;
 	struct ofono_message_waiting *mw;
 	unsigned int mw_watch;

@@ -113,9 +122,13 @@ struct pending_pdu {
 /*
  * @name: Name for the SMS message object (used by D-Bus)
  * @dbus_path: D-Bus path for this object
+ * @sms_mgr: SMS manager / driver object
  * @state: Current state of the (in-transit) SMS
+ * @status_report: message reception/delivery should be acknoledged by
+ *     the network.
  */
 struct tx_queue_entry {
+	struct ofono_sms *sms_mgr;
 	struct pending_pdu *pdus;
 	unsigned char num_pdus;
 	unsigned char cur_pdu;

@@ -375,9 +388,17 @@ static void __ofono_sms_tx_state_set(struct tx_queue_entry *entry,
 	case OFONO_SMS_TX_ST_QUEUED:
 		ofono_sms_tx_state_check(
 			file, line, entry, state_old, state_new,
+			1 << OFONO_SMS_TX_ST_WFA
+			| 1 << OFONO_SMS_TX_ST_DONE
+			| 1 << OFONO_SMS_TX_ST_CANCELING);
+		break;
+	case OFONO_SMS_TX_ST_WFA:
+		ofono_sms_tx_state_check(
+			file, line, entry, state_old, state_new,
 			1 << OFONO_SMS_TX_ST_DONE
 			| 1 << OFONO_SMS_TX_ST_CANCELING
-			| 1 << OFONO_SMS_TX_ST_FAILED);
+			| 1 << OFONO_SMS_TX_ST_FAILED
+			| 1 << OFONO_SMS_TX_ST_EXPIRED);
 		break;
 	case OFONO_SMS_TX_ST_CANCELING:
 		ofono_sms_tx_state_check(

@@ -543,9 +564,14 @@ static void tx_finished(const struct ofono_error *error, int mr, void *data)
 					time(NULL),
 					OFONO_HISTORY_SMS_STATUS_SUBMITTED);
 
-	ofono_sms_tx_state_set(entry, OFONO_SMS_TX_ST_DONE);
-	tx_queue_entry_destroy(entry);
-	g_free(entry);
+	if (entry->status_report) {
+		ofono_sms_tx_state_set(entry, OFONO_SMS_TX_ST_WFA);
+		g_queue_push_tail(sms->tx_wfaq, entry);
+	} else {
+		ofono_sms_tx_state_set(entry, OFONO_SMS_TX_ST_DONE);
+		tx_queue_entry_destroy(entry);
+		g_free(entry);
+	}
 
 	if (g_queue_peek_head(sms->txq)) {
 		DBG("Scheduling next");

@@ -683,6 +709,7 @@ struct tx_queue_entry *sms_msg_send(
 		    entry, ref, ref_offset, msg_id_str);
 	entry->msg_id = ref;
 	entry->receiver = receiver;
+	entry->sms_mgr = sms;
 
 	g_slist_foreach(msg_list, (GFunc)g_free, NULL);
 	g_slist_free(msg_list);

@@ -1217,6 +1244,13 @@ static void sms_remove(struct ofono_atom *atom)
 		sms->txq = NULL;
 	}
 
+	if (sms->tx_wfaq) {
+		g_queue_foreach(sms->tx_wfaq,
+				tx_queue_entry_destroy_free, NULL);
+		g_queue_free(sms->tx_wfaq);
+		sms->tx_wfaq = NULL;
+	}
+
 	if (sms->settings) {
 		g_key_file_set_integer(sms->settings, SETTINGS_GROUP,
 					"NextReference", sms->ref);

@@ -1269,6 +1303,7 @@ struct ofono_sms *ofono_sms_create(struct ofono_modem *modem,
 	sms->sca.type = 129;
 	sms->ref = 1;
 	sms->txq = g_queue_new();
+	sms->tx_wfaq = g_queue_new();
 	sms->atom = __ofono_modem_add_atom(modem, OFONO_ATOM_TYPE_SMS,
 						sms_remove, sms);
 

index 97c7429..faaacbe 100644
@@ -426,6 +426,24 @@ static void __ofono_sms_tx_state_set(struct tx_queue_entry *entry,
 }
 
 
+static DBusMessage *dbus_sms_msg_cancel(
+	DBusConnection * conn, DBusMessage *msg, void *data)
+{
+	gboolean do_network_cancel = FALSE;
+	struct tx_queue_entry *sms_msg = data;
+	if (!dbus_message_get_args(msg, NULL,
+				   DBUS_TYPE_BOOLEAN, &do_network_cancel))
+		return __ofono_error_invalid_args(msg);
+	sms_msg_cancel(sms_msg,
+		       do_network_cancel ? SMS_MSG_CANCEL_IN_NETWORK : 0);
+	sms_msg->msg = dbus_message_ref(msg);
+	__ofono_dbus_pending_reply(
+		&sms_msg->msg,
+		dbus_message_new_method_return(sms_msg->msg));
+	return NULL;
+}
+
+
 /*
  * D-Bus SMS Message interface
  *

@@ -435,6 +453,8 @@ static void __ofono_sms_tx_state_set(struct tx_queue_entry *entry,
 
 static
 GDBusMethodTable sms_msg_methods[] = {
+	{ "Cancel",		DBUS_TYPE_BOOLEAN_AS_STRING,	"",
+	  dbus_sms_msg_cancel, G_DBUS_METHOD_FLAG_ASYNC },
 	{ }
 };
 

@@ -734,6 +754,43 @@ struct tx_queue_entry *sms_msg_send(
 }
 
 
+/**
+ * Cancel a pending SMS message
+ *
+ * @sms_msg: message to cancel
+ * @flags: modifies for the action
+ *
+ * This function cancels a message that is pending or being
+ * actively transmitted.
+ *
+ * \internal
+ *
+ * There is no need to cancel the calling of tx_next() by
+ * g_timeout_add() scheduled in sms_msg_send(). The rationale behind
+ * this is that the tx_next() function is scheduled to go over the
+ * list of messages in the @sms object, so it might have been
+ * scheduled for other messages also rather than just for this one
+ * @sms_msg. By the time it gets to run, it might see the list empty
+ * or see other messages, but @sms_msg won't be there.
+ */
+void sms_msg_cancel(struct tx_queue_entry *sms_msg,
+		    enum sms_msg_cancel_flags flags)
+{
+	struct ofono_sms *sms = sms_msg->sms_mgr;
+	DBG("%s (%p)\n", __func__, sms_msg);
+	if (sms_msg->state == OFONO_SMS_TX_ST_QUEUED)
+		g_queue_remove(sms->txq, sms_msg);
+	else if (sms_msg->state == OFONO_SMS_TX_ST_WFA)
+		g_queue_remove(sms->tx_wfaq, sms_msg);
+	ofono_sms_tx_state_set(sms_msg, OFONO_SMS_TX_ST_CANCELING);
+	if (flags & SMS_MSG_CANCEL_IN_NETWORK)
+		ofono_warn("%s(): SMS_MSG_CANCEL_IN_NETWORK support "
+			   "not yet implemented\n", __func__);
+	ofono_sms_tx_state_set(sms_msg, OFONO_SMS_TX_ST_CANCELLED);
+	tx_queue_entry_destroy(sms_msg);
+}
+
+
 /*
  * D-Bus: Send a SMS text message
  *

index 40df71f..ad1e560 100644
@@ -559,6 +559,21 @@ gboolean cbs_topic_in_range(unsigned int topic, GSList *ranges);
 
 char *ussd_decode(int dcs, int len, const unsigned char *data);
 
+/*
+ * SMS Message API
+ */
+
+enum sms_msg_cancel_flags {
+	/**
+	 * The cancelled message will be reported to the network so it
+	 * tries to cancel it if in transit.
+	 */
+	SMS_MSG_CANCEL_IN_NETWORK = 0x1,
+};
+
+struct tx_queue_entry;
+void sms_msg_cancel(struct tx_queue_entry *sms_msg, enum sms_msg_cancel_flags);
+
 enum {
 	/* Note this has to be a multiple of sizeof(guint32);
 	 * Compilation will assert-fail if this is not met. */

index faaacbe..4ad9e61 100644
@@ -134,7 +134,7 @@ struct tx_queue_entry {
 	unsigned char cur_pdu;
 	unsigned int msg_id;
 	unsigned int retry;
-	DBusMessage *msg;
+	DBusMessage *dbus_msg;
 	gboolean status_report;
 	struct sms_address receiver;
 	char *name;

@@ -436,10 +436,10 @@ static DBusMessage *dbus_sms_msg_cancel(
 		return __ofono_error_invalid_args(msg);
 	sms_msg_cancel(sms_msg,
 		       do_network_cancel ? SMS_MSG_CANCEL_IN_NETWORK : 0);
-	sms_msg->msg = dbus_message_ref(msg);
+	sms_msg->dbus_msg = dbus_message_ref(msg);
 	__ofono_dbus_pending_reply(
-		&sms_msg->msg,
-		dbus_message_new_method_return(sms_msg->msg));
+		&sms_msg->dbus_msg,
+		dbus_message_new_method_return(sms_msg->dbus_msg));
 	return NULL;
 }
 

@@ -507,9 +507,9 @@ static void tx_queue_entry_destroy(struct tx_queue_entry *entry)
 	g_free(entry->pdus);
 	g_free(entry->name);
 	entry->state = __OFONO_SMS_TX_ST_INVALID;
-	if (entry->msg) {
-		dbus_message_unref(entry->msg);
-		entry->msg = NULL;
+	if (entry->dbus_msg) {
+		dbus_message_unref(entry->dbus_msg);
+		entry->dbus_msg = NULL;
 	}
 }
 

@@ -543,8 +543,8 @@ static void tx_finished(const struct ofono_error *error, int mr, void *data)
 
 		ofono_sms_tx_state_set(entry, OFONO_SMS_TX_ST_CANCELING);
 		entry = g_queue_pop_head(sms->txq);
-		__ofono_dbus_pending_reply(&entry->msg,
-					__ofono_error_failed(entry->msg));
+		__ofono_dbus_pending_reply(&entry->dbus_msg,
+					__ofono_error_failed(entry->dbus_msg));
 
 		__ofono_history_sms_send_status(modem, entry->msg_id,
 					time(NULL),

@@ -578,8 +578,9 @@ static void tx_finished(const struct ofono_error *error, int mr, void *data)
 	}
 
 	entry = g_queue_pop_head(sms->txq);
-	__ofono_dbus_pending_reply(&entry->msg,
-				dbus_message_new_method_return(entry->msg));
+	__ofono_dbus_pending_reply(
+		&entry->dbus_msg,
+		dbus_message_new_method_return(entry->dbus_msg));
 	__ofono_history_sms_send_status(modem, entry->msg_id,
 					time(NULL),
 					OFONO_HISTORY_SMS_STATUS_SUBMITTED);

@@ -817,7 +818,7 @@ static DBusMessage *dbus_SendMessage(DBusConnection *conn, DBusMessage *msg,
 	if (sms_msg == NULL)
 		return __ofono_error_invalid_format(msg);
 	/* Unreferenced upon tx_queue_entry_destroy() */
-	sms_msg->msg = dbus_message_ref(msg);
+	sms_msg->dbus_msg = dbus_message_ref(msg);
 	return NULL;
 }
 

index 4ad9e61..77904ad 100644
@@ -86,6 +86,24 @@ enum ofono_sms_tx_state {
 };
 
 
+static
+const char *ofono_sms_tx_state_to_string(enum ofono_sms_tx_state status)
+{
+	switch (status) {
+	case OFONO_SMS_TX_ST_UNINITIALIZED:	return "UNINITIALIZED";
+	case OFONO_SMS_TX_ST_QUEUED:		return "QUEUED";
+	case OFONO_SMS_TX_ST_WFA:		return "WFA";
+	case OFONO_SMS_TX_ST_DONE:		return "DONE";
+	case OFONO_SMS_TX_ST_CANCELING:		return "CANCELING";
+	case OFONO_SMS_TX_ST_CANCELLED:		return "CANCELLED";
+	case OFONO_SMS_TX_ST_FAILED:		return "FAILED";
+	case OFONO_SMS_TX_ST_EXPIRED:		return "EXPIRED";
+	default:
+						return "INVALID";
+	}
+}
+
+
 /**
  * @wfaq: Waiting-For-Acknoledgement queue; messages in this queue
  *     have been delivered but are waiting to be acknoledged by the

@@ -426,6 +444,29 @@ static void __ofono_sms_tx_state_set(struct tx_queue_entry *entry,
 }
 
 
+static DBusMessage *dbus_sms_msg_get_properties(
+	DBusConnection * conn, DBusMessage *dbus_msg, void *_sms_msg)
+{
+	struct tx_queue_entry *sms_msg = _sms_msg;
+	DBusMessage *reply;
+	DBusMessageIter iter;
+	DBusMessageIter dict;
+	const char *str;
+
+	reply = dbus_message_new_method_return(dbus_msg);
+	if (!reply)
+		return NULL;
+	dbus_message_iter_init_append(reply, &iter);
+	dbus_message_iter_open_container(&iter, DBUS_TYPE_ARRAY,
+					 OFONO_PROPERTIES_ARRAY_SIGNATURE,
+					 &dict);
+	str = ofono_sms_tx_state_to_string(sms_msg->state);
+	ofono_dbus_dict_append(&dict, "TXState", DBUS_TYPE_STRING, &str);
+	dbus_message_iter_close_container(&iter, &dict);
+	return reply;
+}
+
+
 static DBusMessage *dbus_sms_msg_cancel(
 	DBusConnection * conn, DBusMessage *msg, void *data)
 {

@@ -453,6 +494,8 @@ static DBusMessage *dbus_sms_msg_cancel(
 
 static
 GDBusMethodTable sms_msg_methods[] = {
+	{ "GetProperties",	"",	"a{sv}",
+	  dbus_sms_msg_get_properties, G_DBUS_METHOD_FLAG_ASYNC },
 	{ "Cancel",		DBUS_TYPE_BOOLEAN_AS_STRING,	"",
 	  dbus_sms_msg_cancel, G_DBUS_METHOD_FLAG_ASYNC },
 	{ }

index 77904ad..11d1f33 100644
@@ -380,6 +380,32 @@ static void ofono_sms_tx_state_check(const char *file, unsigned line,
 
 
 /*
+ * Send a PropertyChange signal when the state changes
+ *
+ * D-Bus typing is "ss" for variable/value.
+ */
+static
+void __sms_msg_state_change_dbus_signal(struct tx_queue_entry *sms_msg)
+{
+	DBusConnection *dbus_conn = ofono_dbus_get_connection();
+	DBusMessage *dbus_signal;
+	DBusMessageIter iter;
+	const char *property = "TXState";
+	const char *new_state_str;
+
+	dbus_signal = dbus_message_new_signal(
+		sms_msg->dbus_path, SMS_MSG_INTERFACE, "PropertyChanged");
+	if (!dbus_signal)
+		return;
+	dbus_message_iter_init_append(dbus_signal, &iter);
+	dbus_message_iter_append_basic(&iter, DBUS_TYPE_STRING, &property);
+	new_state_str = ofono_sms_tx_state_to_string(sms_msg->state);
+	dbus_message_iter_append_basic(&iter, DBUS_TYPE_STRING, &new_state_str);
+	g_dbus_send_message(dbus_conn, dbus_signal);
+}
+
+
+/*
  * Set a pending SMS's state
  *
  * This is just syntatic sugar that validates that the transition is

@@ -441,6 +467,7 @@ static void __ofono_sms_tx_state_set(struct tx_queue_entry *entry,
 	ofono_debug("%s:%d: SMS state change: %p %u -> %u\n",
 		    file, line, entry, state_old, state_new);
 	entry->state = state_new;
+	__sms_msg_state_change_dbus_signal(entry);
 }
 
 

@@ -584,10 +611,7 @@ static void tx_finished(const struct ofono_error *error, int mr, void *data)
 
 		DBG("Max retries reached, giving up");
 
-		ofono_sms_tx_state_set(entry, OFONO_SMS_TX_ST_CANCELING);
 		entry = g_queue_pop_head(sms->txq);
-		__ofono_dbus_pending_reply(&entry->dbus_msg,
-					__ofono_error_failed(entry->dbus_msg));
 
 		__ofono_history_sms_send_status(modem, entry->msg_id,
 					time(NULL),

@@ -621,9 +645,6 @@ static void tx_finished(const struct ofono_error *error, int mr, void *data)
 	}
 
 	entry = g_queue_pop_head(sms->txq);
-	__ofono_dbus_pending_reply(
-		&entry->dbus_msg,
-		dbus_message_new_method_return(entry->dbus_msg));
 	__ofono_history_sms_send_status(modem, entry->msg_id,
 					time(NULL),
 					OFONO_HISTORY_SMS_STATUS_SUBMITTED);

index 11d1f33..96315b2 100644
@@ -504,11 +504,7 @@ static DBusMessage *dbus_sms_msg_cancel(
 		return __ofono_error_invalid_args(msg);
 	sms_msg_cancel(sms_msg,
 		       do_network_cancel ? SMS_MSG_CANCEL_IN_NETWORK : 0);
-	sms_msg->dbus_msg = dbus_message_ref(msg);
-	__ofono_dbus_pending_reply(
-		&sms_msg->dbus_msg,
-		dbus_message_new_method_return(sms_msg->dbus_msg));
-	return NULL;
+	return dbus_message_new_method_return(msg);
 }
 
 

@@ -522,9 +518,9 @@ static DBusMessage *dbus_sms_msg_cancel(
 static
 GDBusMethodTable sms_msg_methods[] = {
 	{ "GetProperties",	"",	"a{sv}",
-	  dbus_sms_msg_get_properties, G_DBUS_METHOD_FLAG_ASYNC },
+	  dbus_sms_msg_get_properties, 0 },
 	{ "Cancel",		DBUS_TYPE_BOOLEAN_AS_STRING,	"",
-	  dbus_sms_msg_cancel, G_DBUS_METHOD_FLAG_ASYNC },
+	  dbus_sms_msg_cancel, 0 },
 	{ }
 };
 

@@ -577,10 +573,6 @@ static void tx_queue_entry_destroy(struct tx_queue_entry *entry)
 	g_free(entry->pdus);
 	g_free(entry->name);
 	entry->state = __OFONO_SMS_TX_ST_INVALID;
-	if (entry->dbus_msg) {
-		dbus_message_unref(entry->dbus_msg);
-		entry->dbus_msg = NULL;
-	}
 }
 
 static void tx_queue_entry_destroy_free(gpointer _entry, gpointer unused)

@@ -872,6 +864,7 @@ static DBusMessage *dbus_SendMessage(DBusConnection *conn, DBusMessage *msg,
 	const char *to;
 	const char *text;
 	struct tx_queue_entry *sms_msg;
+	DBusMessage *reply;
 
 	if (!dbus_message_get_args(msg, NULL, DBUS_TYPE_STRING, &to,
 					DBUS_TYPE_STRING, &text,

@@ -881,9 +874,13 @@ static DBusMessage *dbus_SendMessage(DBusConnection *conn, DBusMessage *msg,
 	sms_msg = sms_msg_send(sms, to, text, SMS_MSG_SEND_HISTORY);
 	if (sms_msg == NULL)
 		return __ofono_error_invalid_format(msg);
-	/* Unreferenced upon tx_queue_entry_destroy() */
-	sms_msg->dbus_msg = dbus_message_ref(msg);
-	return NULL;
+	reply = dbus_message_new_method_return(msg);
+	if (!reply)
+		return NULL;
+	dbus_message_append_args(reply,
+				 DBUS_TYPE_STRING, &sms_msg->dbus_path,
+				 DBUS_TYPE_INVALID);
+	return reply;
 }
 
 

index 96315b2..1b35fa9 100644
@@ -752,6 +752,7 @@ struct tx_queue_entry *sms_msg_send(
 	struct sms_address receiver;
 	DECLARE_SMS_ADDR_STR(receiver_str);
 	const char *sms_path = __ofono_atom_get_path(sms->atom);
+	gboolean status_report;
 
 	if (valid_phone_number_format(to) == FALSE)
 		return NULL;

@@ -767,8 +768,14 @@ struct tx_queue_entry *sms_msg_send(
 	    == FALSE)
 		return NULL;
 
-	msg_list = sms_text_prepare(text, 0, TRUE, &ref_offset,
-					sms->use_delivery_reports);
+	/*
+	 * Request submit report? Set it in sms->submit for the
+	 * encoding code to decide how to encode it, take the default
+	 * from the SMS manager object.
+	 */
+	status_report = flags & SMS_MSG_SEND_STATUS_REPORT ?
+		TRUE : sms->use_delivery_reports;
+	msg_list = sms_text_prepare(text, 0, TRUE, &ref_offset, status_report);
 
 	if (!msg_list)
 		return NULL;

@@ -790,7 +797,7 @@ struct tx_queue_entry *sms_msg_send(
 
 	g_slist_foreach(msg_list, (GFunc)g_free, NULL);
 	g_slist_free(msg_list);
-	entry->status_report = sms->use_delivery_reports;
+	entry->status_report = status_report;
 	entry->name = g_strdup_printf(SMS_MSG_NAME_FMT, sms_path,
 				      msg_id_str, entry->num_pdus);
 	ofono_debug("sms/entry %p name %s\n", entry, entry->name);

index ad1e560..bf23f0c 100644
@@ -569,6 +569,8 @@ enum sms_msg_cancel_flags {
 	 * tries to cancel it if in transit.
 	 */
 	SMS_MSG_CANCEL_IN_NETWORK = 0x1,
+	/* Request and wait for receipt acknowledgement from the network */
+	SMS_MSG_SEND_STATUS_REPORT = 0x02,
 };
 
 struct tx_queue_entry;

index 27a3d64..bc0f80f 100644
@@ -1148,6 +1148,21 @@ static void handle_deliver(struct ofono_sms *sms, const struct sms *incoming)
 	g_slist_free(l);
 }
 
+
+static void  __sms_find_destroy_by_msg_id(gpointer _sms_msg, gpointer _msg_id)
+{
+	unsigned msg_id = (unsigned) _msg_id;
+	struct tx_queue_entry *sms_msg = _sms_msg;
+
+	if (sms_msg->msg_id != msg_id)
+		return;
+	ofono_debug("SMS: ACKED %p msg_id match %x", sms_msg, msg_id);
+	g_queue_remove(sms_msg->sms_mgr->tx_wfaq, sms_msg);
+	ofono_sms_tx_state_set(sms_msg, OFONO_SMS_TX_ST_DONE);
+	tx_queue_entry_destroy_free(sms_msg, NULL);
+}
+
+
 static void handle_sms_status_report(struct ofono_sms *sms,
 						const struct sms *incoming)
 {

@@ -1159,6 +1174,9 @@ static void handle_sms_status_report(struct ofono_sms *sms,
 						&delivered) == FALSE)
 		return;
 
+	g_queue_foreach(sms->tx_wfaq, __sms_find_destroy_by_msg_id,
+			(void *) msg_id);
+
 	__ofono_history_sms_send_status(modem, msg_id, time(NULL),
 			delivered ? OFONO_HISTORY_SMS_STATUS_DELIVERED :
 			OFONO_HISTORY_SMS_STATUS_DELIVER_FAILED);

index cdf28f9..54278ad 100644
@@ -2831,6 +2831,9 @@ static inline GSList *sms_list_append(GSList *l, const struct sms *in)
  * Returns a list of sms messages in order.  If ref_offset is given,
  * then the ref_offset contains the reference number offset or 0
  * if no concatenation took place.
+ *
+ * @use_delivery_reports: value for the Status-Report-Request field
+ *     (23.040 3.2.9, 9.2.2.2)
  */
 GSList *sms_text_prepare(const char *utf8, guint16 ref,
 				gboolean use_16bit, int *ref_offset,