Merge branch 'master' into sms
diff --git a/openbsc/src/abis_rsl.c b/openbsc/src/abis_rsl.c
index c2ef9e5..3495e6c 100644
--- a/openbsc/src/abis_rsl.c
+++ b/openbsc/src/abis_rsl.c
@@ -811,10 +811,8 @@
 		if (TLVP_PRESENT(&tp, RSL_IE_CAUSE) &&
 		    TLVP_LEN(&tp, RSL_IE_CAUSE) >= 1 &&
 		    *TLVP_VAL(&tp, RSL_IE_CAUSE) == 0x18) {
-			if (msg->lchan->use_count > 0) {
-				DEBUGPC(DRSL, "Cause 0x18 IGNORING, lchan in use! (%d times)\n", msg->lchan->use_count);
-				return 0;
-			}
+			DEBUGPC(DRSL, "Cause 0x18 IGNORING\n");
+			return 0;
 		}
 	}
 
@@ -1106,6 +1104,9 @@
 
 	DEBUGPC(DRLL, "cause=0x%02x", rlm_cause[1]);
 		
+	if (rlm_cause[1] == RLL_CAUSE_T200_EXPIRED)
+		return rsl_chan_release(msg->lchan);
+
 	return 0;
 }
 
diff --git a/openbsc/src/gsm_04_08.c b/openbsc/src/gsm_04_08.c
index dc70c86..2312e8a 100644
--- a/openbsc/src/gsm_04_08.c
+++ b/openbsc/src/gsm_04_08.c
@@ -385,7 +385,7 @@
 	 * Cancel any outstanding location updating request
 	 * operation taking place on the lchan.
 	 */
-	struct gsm_lchan *lchan = (struct gsm_lchan *)handler_data;
+	struct gsm_lchan *lchan = (struct gsm_lchan *)signal_data;
 	if (!lchan)
 		return 0;
 
@@ -1256,6 +1256,9 @@
 		break;
 	}
 
+	/* schedule the reject timer */
+	schedule_reject(lchan);
+
 	if (!subscr) {
 		DEBUGPC(DRR, "<- Can't find any subscriber for this ID\n");
 		/* FIXME: request id? close channel? */
@@ -1264,12 +1267,8 @@
 
 	lchan->subscr = subscr;
 
-	/*
-	 * Schedule the reject timer and check if we can let the
-	 * subscriber into our network immediately or if we need to wait
-	 * for identity responses.
-	 */
-	schedule_reject(lchan);
+	/* check if we can let the subscriber into our network immediately
+	 * or if we need to wait for identity responses. */
 	return gsm0408_authorize(lchan, msg);
 }
 
@@ -3381,8 +3380,7 @@
 
 	/* Callref unknown */
 	if (!trans) {
-		if (msg_type != MNCC_SETUP_REQ ||
-		    (!data->called.number[0] && !data->imsi[0])) {
+		if (msg_type != MNCC_SETUP_REQ) {
 			DEBUGP(DCC, "(bts - trx - ts - ti -- sub %s) "
 				"Received '%s' from MNCC with "
 				"unknown callref %d\n", data->called.number,
diff --git a/openbsc/src/input/misdn.c b/openbsc/src/input/misdn.c
index 367d8e4..a04c2ab 100644
--- a/openbsc/src/input/misdn.c
+++ b/openbsc/src/input/misdn.c
@@ -154,6 +154,7 @@
 		ret = e1inp_event(e1i_ts, EVT_E1_TEI_DN, l2addr.tei, l2addr.sapi);
 		break;
 	case DL_DATA_IND:
+	case DL_UNITDATA_IND:
 		msg->l2h = msg->data + MISDN_HEADER_LEN;
 		DEBUGP(DMI, "RX: %s\n", hexdump(msgb_l2(msg), ret - MISDN_HEADER_LEN));
 		ret = e1inp_rx_ts(e1i_ts, msg, l2addr.tei, l2addr.sapi);