diff --git a/include/osmo-bts/vty.h b/include/osmo-bts/vty.h
index 1bc7e71..510abab 100644
--- a/include/osmo-bts/vty.h
+++ b/include/osmo-bts/vty.h
@@ -15,7 +15,7 @@ extern struct cmd_element ournode_end_cmd;
 enum node_type bts_vty_go_parent(struct vty *vty);
 int bts_vty_is_config_node(struct vty *vty, int node);
 
-int bts_vty_init(const struct log_info *cat);
+int bts_vty_init(struct gsm_bts *bts, const struct log_info *cat);
 
 extern struct vty_app_info bts_vty_info;
 
diff --git a/src/common/vty.c b/src/common/vty.c
index 6b57b0b..37f75fc 100644
--- a/src/common/vty.c
+++ b/src/common/vty.c
@@ -24,12 +24,15 @@
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
+#include <ctype.h>
 
 #include <osmocom/core/talloc.h>
 #include <osmocom/gsm/abis_nm.h>
 #include <osmocom/vty/vty.h>
 #include <osmocom/vty/command.h>
 #include <osmocom/vty/logging.h>
+#include <osmocom/vty/misc.h>
+#include <osmocom/core/gsmtap.h>
 
 #include <osmocom/trau/osmo_ortp.h>
 
@@ -44,7 +47,7 @@
 #include <osmo-bts/bts_model.h>
 #include <osmo-bts/measurement.h>
 #include <osmo-bts/vty.h>
-
+#include <osmo-bts/l1sap.h>
 
 enum node_type bts_vty_go_parent(struct vty *vty)
 {
@@ -158,10 +161,38 @@ DEFUN(cfg_bts_trx, cfg_bts_trx_cmd,
 	return CMD_SUCCESS;
 }
 
+/* FIXME: move to libosmocore ? */
+static char buf_casecnvt[256];
+char *osmo_str_tolower(const char *in)
+{
+	int len, i;
+
+	if (!in)
+		return NULL;
+
+	len = strlen(in);
+	if (len > sizeof(buf_casecnvt))
+		len = sizeof(buf_casecnvt);
+
+	for (i = 0; i < len; i++) {
+		buf_casecnvt[i] = tolower(in[i]);
+		if (in[i] == '\0')
+			break;
+	}
+	if (i < sizeof(buf_casecnvt))
+		buf_casecnvt[i] = '\0';
+
+	/* just to make sure we're always zero-terminated */
+	buf_casecnvt[sizeof(buf_casecnvt)-1] = '\0';
+
+	return buf_casecnvt;
+}
+
 static void config_write_bts_single(struct vty *vty, struct gsm_bts *bts)
 {
 	struct gsm_bts_role_bts *btsb = bts_role_bts(bts);
 	struct gsm_bts_trx *trx;
+	int i;
 
 	vty_out(vty, "bts %u%s", bts->nr, VTY_NEWLINE);
 	if (bts->description)
@@ -183,6 +214,17 @@ static void config_write_bts_single(struct vty *vty, struct gsm_bts *bts)
 			btsb->agch_queue_thresh_level, btsb->agch_queue_low_level,
 			btsb->agch_queue_high_level, VTY_NEWLINE);
 
+	for (i = 0; i < 32; i++) {
+		if (gsmtap_sapi_mask & (1 << i)) {
+			const char *name = get_value_string(gsmtap_sapi_names, i);
+			vty_out(vty, " gsmtap-sapi %s%s", osmo_str_tolower(name), VTY_NEWLINE);
+		}
+	}
+	if (gsmtap_sapi_acch) {
+		const char *name = get_value_string(gsmtap_sapi_names, GSMTAP_CHANNEL_ACCH);
+		vty_out(vty, " gsmtap-sapi %s%s", osmo_str_tolower(name), VTY_NEWLINE);
+	}
+
 	bts_model_config_write_bts(vty, bts);
 
 	llist_for_each_entry(trx, &bts->trx_list, list) {
@@ -588,6 +630,36 @@ static struct gsm_lchan *resolve_lchan(struct gsm_network *net,
 	"logical channel commands\n"	\
 	"logical channel number\n"
 
+DEFUN(cfg_trx_gsmtap_sapi, cfg_trx_gsmtap_sapi_cmd,
+	"HIDDEN", "HIDDEN")
+{
+	int sapi;
+
+	sapi = get_string_value(gsmtap_sapi_names, argv[0]);
+
+	if (sapi == GSMTAP_CHANNEL_ACCH)
+		gsmtap_sapi_acch = 1;
+	else
+		gsmtap_sapi_mask |= (1 << sapi);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_trx_no_gsmtap_sapi, cfg_trx_no_gsmtap_sapi_cmd,
+	"HIDDEN", "HIDDEN")
+{
+	int sapi;
+
+	sapi = get_string_value(gsmtap_sapi_names, argv[0]);
+
+	if (sapi == GSMTAP_CHANNEL_ACCH)
+		gsmtap_sapi_acch = 0;
+	else
+		gsmtap_sapi_mask &= ~(1 << sapi);
+
+	return CMD_SUCCESS;
+}
+
 DEFUN(bts_t_t_l_jitter_buf,
 	bts_t_t_l_jitter_buf_cmd,
 	"bts <0-0> trx <0-0> ts <0-7> lchan <0-1> rtp jitter-buffer <0-10000>",
@@ -614,8 +686,58 @@ DEFUN(bts_t_t_l_jitter_buf,
 	return CMD_SUCCESS;
 }
 
-int bts_vty_init(const struct log_info *cat)
+DEFUN(bts_t_t_l_loopback,
+	bts_t_t_l_loopback_cmd,
+	"bts <0-0> trx <0-0> ts <0-7> lchan <0-1> loopback",
+	BTS_T_T_L_STR "Set loopback\n")
 {
+	struct gsm_network *net = gsmnet_from_vty(vty);
+	struct gsm_lchan *lchan;
+
+	lchan = resolve_lchan(net, argv, 0);
+	if (!lchan) {
+		vty_out(vty, "%% can't find BTS%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	lchan->loopback = 1;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(no_bts_t_t_l_loopback,
+	no_bts_t_t_l_loopback_cmd,
+	"no bts <0-0> trx <0-0> ts <0-7> lchan <0-1> loopback",
+	NO_STR BTS_T_T_L_STR "Set loopback\n")
+{
+	struct gsm_network *net = gsmnet_from_vty(vty);
+	struct gsm_lchan *lchan;
+
+	lchan = resolve_lchan(net, argv, 0);
+	if (!lchan) {
+		vty_out(vty, "%% can't find BTS%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	lchan->loopback = 0;
+
+	return CMD_SUCCESS;
+}
+
+int bts_vty_init(struct gsm_bts *bts, const struct log_info *cat)
+{
+	cfg_trx_gsmtap_sapi_cmd.string = vty_cmd_string_from_valstr(bts, gsmtap_sapi_names,
+						"gsmtap-sapi (",
+						"|",")", VTY_DO_LOWER);
+	cfg_trx_gsmtap_sapi_cmd.doc = vty_cmd_string_from_valstr(bts, gsmtap_sapi_names,
+						"GSMTAP SAPI\n",
+						"\n", "", 0);
+
+	cfg_trx_no_gsmtap_sapi_cmd.string = vty_cmd_string_from_valstr(bts, gsmtap_sapi_names,
+						"no gsmtap-sapi (",
+						"|",")", VTY_DO_LOWER);
+	cfg_trx_no_gsmtap_sapi_cmd.doc = vty_cmd_string_from_valstr(bts, gsmtap_sapi_names,
+						NO_STR "GSMTAP SAPI\n",
+						"\n", "", 0);
+
 	install_element_ve(&show_bts_cmd);
 
 	logging_vty_add_cmds(cat);
@@ -635,6 +757,9 @@ int bts_vty_init(const struct log_info *cat)
 	install_element(BTS_NODE, &cfg_bts_agch_queue_mgmt_default_cmd);
 	install_element(BTS_NODE, &cfg_bts_agch_queue_mgmt_params_cmd);
 
+	install_element(BTS_NODE, &cfg_trx_gsmtap_sapi_cmd);
+	install_element(BTS_NODE, &cfg_trx_no_gsmtap_sapi_cmd);
+
 	/* add and link to TRX config node */
 	install_element(BTS_NODE, &cfg_bts_trx_cmd);
 	install_node(&trx_node, config_write_dummy);
diff --git a/src/osmo-bts-sysmo/main.c b/src/osmo-bts-sysmo/main.c
index 51619ee..27b593b 100644
--- a/src/osmo-bts-sysmo/main.c
+++ b/src/osmo-bts-sysmo/main.c
@@ -310,8 +310,9 @@ int main(int argc, char **argv)
 
 	bts_log_init(NULL);
 
+	bts = gsm_bts_alloc(tall_bts_ctx);
 	vty_init(&bts_vty_info);
-	bts_vty_init(&bts_log_info);
+	bts_vty_init(bts, &bts_log_info);
 
 	handle_options(argc, argv);
 
@@ -327,7 +328,6 @@ int main(int argc, char **argv)
 		}
 	}
 
-	bts = gsm_bts_alloc(tall_bts_ctx);
 	if (bts_init(bts) < 0) {
 		fprintf(stderr, "unable to open bts\n");
 		exit(1);
diff --git a/src/osmo-bts-sysmo/sysmobts_vty.c b/src/osmo-bts-sysmo/sysmobts_vty.c
index 8b617d7..cad29f5 100644
--- a/src/osmo-bts-sysmo/sysmobts_vty.c
+++ b/src/osmo-bts-sysmo/sysmobts_vty.c
@@ -84,34 +84,6 @@ DEFUN(cfg_bts_no_auto_band, cfg_bts_no_auto_band_cmd,
 	return CMD_SUCCESS;
 }
 
-DEFUN(cfg_trx_gsmtap_sapi, cfg_trx_gsmtap_sapi_cmd,
-	"HIDDEN", "HIDDEN")
-{
-	struct gsm_bts_trx *trx = vty->index;
-	struct femtol1_hdl *fl1h = trx_femtol1_hdl(trx);
-	int sapi;
-
-	sapi = get_string_value(femtobts_l1sapi_names, argv[0]);
-
-	fl1h->gsmtap_sapi_mask |= (1 << sapi);
-
-	return CMD_SUCCESS;
-}
-
-DEFUN(cfg_trx_no_gsmtap_sapi, cfg_trx_no_gsmtap_sapi_cmd,
-	"HIDDEN", "HIDDEN")
-{
-	struct gsm_bts_trx *trx = vty->index;
-	struct femtol1_hdl *fl1h = trx_femtol1_hdl(trx);
-	int sapi;
-
-	sapi = get_string_value(femtobts_l1sapi_names, argv[0]);
-
-	fl1h->gsmtap_sapi_mask &= ~(1 << sapi);
-
-	return CMD_SUCCESS;
-}
-
 DEFUN(cfg_trx_clkcal_eeprom, cfg_trx_clkcal_eeprom_cmd,
 	"clock-calibration eeprom",
 	"Use the eeprom clock calibration value\n")
@@ -497,37 +469,9 @@ void bts_model_config_write_bts(struct vty *vty, struct gsm_bts *bts)
 		vty_out(vty, " auto-band%s", VTY_NEWLINE);
 }
 
-/* FIXME: move to libosmocore ? */
-static char buf_casecnvt[256];
-char *osmo_str_tolower(const char *in)
-{
-	int len, i;
-
-	if (!in)
-		return NULL;
-
-	len = strlen(in);
-	if (len > sizeof(buf_casecnvt))
-		len = sizeof(buf_casecnvt);
-
-	for (i = 0; i < len; i++) {
-		buf_casecnvt[i] = tolower(in[i]);
-		if (in[i] == '\0')
-			break;
-	}
-	if (i < sizeof(buf_casecnvt))
-		buf_casecnvt[i] = '\0';
-
-	/* just to make sure we're always zero-terminated */
-	buf_casecnvt[sizeof(buf_casecnvt)-1] = '\0';
-
-	return buf_casecnvt;
-}
-
 void bts_model_config_write_trx(struct vty *vty, struct gsm_bts_trx *trx)
 {
 	struct femtol1_hdl *fl1h = trx_femtol1_hdl(trx);
-	int i;
 
 	if (fl1h->clk_use_eeprom)
 		vty_out(vty, "  clock-calibration eeprom%s", VTY_NEWLINE);
@@ -549,14 +493,6 @@ void bts_model_config_write_trx(struct vty *vty, struct gsm_bts_trx *trx)
 	if (trx->nominal_power != sysmobts_get_nominal_power(trx))
 		vty_out(vty, "  nominal-tx-power %d%s", trx->nominal_power,
 			VTY_NEWLINE);
-
-	for (i = 0; i < 32; i++) {
-		if (fl1h->gsmtap_sapi_mask & (1 << i)) {
-			const char *name = get_value_string(femtobts_l1sapi_names, i);
-			vty_out(vty, "  gsmtap-sapi %s%s", osmo_str_tolower(name),
-				VTY_NEWLINE);
-		}
-	}
 }
 
 int bts_model_vty_init(struct gsm_bts *bts)
@@ -578,20 +514,6 @@ int bts_model_vty_init(struct gsm_bts *bts)
 						NO_STR TRX_STR DSP_TRACE_F_STR,
 						"\n", "", 0);
 
-	cfg_trx_gsmtap_sapi_cmd.string = vty_cmd_string_from_valstr(bts, femtobts_l1sapi_names,
-						"gsmtap-sapi (",
-						"|",")", VTY_DO_LOWER);
-	cfg_trx_gsmtap_sapi_cmd.doc = vty_cmd_string_from_valstr(bts, femtobts_l1sapi_names,
-						"GSMTAP SAPI\n",
-						"\n", "", 0);
-
-	cfg_trx_no_gsmtap_sapi_cmd.string = vty_cmd_string_from_valstr(bts, femtobts_l1sapi_names,
-						"no gsmtap-sapi (",
-						"|",")", VTY_DO_LOWER);
-	cfg_trx_no_gsmtap_sapi_cmd.doc = vty_cmd_string_from_valstr(bts, femtobts_l1sapi_names,
-						NO_STR "GSMTAP SAPI\n",
-						"\n", "", 0);
-
 	install_element_ve(&show_dsp_trace_f_cmd);
 	install_element_ve(&show_sys_info_cmd);
 	install_element_ve(&show_trx_clksrc_cmd);
@@ -614,8 +536,6 @@ int bts_model_vty_init(struct gsm_bts *bts)
 	install_element(TRX_NODE, &cfg_trx_clkcal_def_cmd);
 	install_element(TRX_NODE, &cfg_trx_clksrc_cmd);
 	install_element(TRX_NODE, &cfg_trx_cal_path_cmd);
-	install_element(TRX_NODE, &cfg_trx_gsmtap_sapi_cmd);
-	install_element(TRX_NODE, &cfg_trx_no_gsmtap_sapi_cmd);
 	install_element(TRX_NODE, &cfg_trx_ul_power_target_cmd);
 	install_element(TRX_NODE, &cfg_trx_min_qual_rach_cmd);
 	install_element(TRX_NODE, &cfg_trx_min_qual_norm_cmd);
