diff --git a/openbsc/src/libmsc/gsm_04_08.c b/openbsc/src/libmsc/gsm_04_08.c
index 08dac63..aa3d78a9 100644
--- a/openbsc/src/libmsc/gsm_04_08.c
+++ b/openbsc/src/libmsc/gsm_04_08.c
@@ -187,7 +187,7 @@
 int gsm48_secure_channel(struct gsm_subscriber_connection *conn, int key_seq,
                          gsm_cbfn *cb, void *cb_data)
 {
-	struct gsm_network *net = conn->bts->network;
+	struct gsm_network *net = conn->network;
 	struct gsm_subscriber *subscr = conn->subscr;
 	struct gsm_security_operation *op;
 	struct gsm_auth_tuple atuple;
@@ -321,7 +321,7 @@
 static int finish_lu(struct gsm_subscriber_connection *conn)
 {
 	int rc = 0;
-	int avoid_tmsi = conn->bts->network->avoid_tmsi;
+	int avoid_tmsi = conn->network->avoid_tmsi;
 
 	/* We're all good */
 	if (avoid_tmsi) {
@@ -332,7 +332,7 @@
 	}
 
 	rc = gsm0408_loc_upd_acc(conn);
-	if (conn->bts->network->send_mm_info) {
+	if (conn->network->send_mm_info) {
 		/* send MM INFO with network name */
 		rc = gsm48_tx_mm_info(conn);
 	}
@@ -429,7 +429,7 @@
 	 * we have a subscriber connection.
 	 */
 restart:
-	llist_for_each_entry_safe(trans, temp, &conn->bts->network->trans_list, entry) {
+	llist_for_each_entry_safe(trans, temp, &conn->network->trans_list, entry) {
 		if (trans->conn == conn) {
 			trans_free(trans);
 			goto restart;
@@ -457,7 +457,7 @@
 	struct gsm_bts *bts = conn->bts;
 	struct msgb *msg;
 
-	rate_ctr_inc(&bts->network->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_RESP_REJECT]);
+	rate_ctr_inc(&conn->network->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_RESP_REJECT]);
 
 	msg = gsm48_create_loc_upd_rej(cause);
 	if (!msg) {
@@ -477,7 +477,6 @@
 /* Chapter 9.2.13 : Send LOCATION UPDATE ACCEPT */
 static int gsm0408_loc_upd_acc(struct gsm_subscriber_connection *conn)
 {
-	struct gsm_bts *bts = conn->bts;
 	struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 LOC UPD ACC");
 	struct gsm48_hdr *gh;
 	struct gsm48_loc_area_id *lai;
@@ -490,8 +489,9 @@
 	gh->msg_type = GSM48_MT_MM_LOC_UPD_ACCEPT;
 
 	lai = (struct gsm48_loc_area_id *) msgb_put(msg, sizeof(*lai));
-	gsm48_generate_lai(lai, bts->network->country_code,
-		     bts->network->network_code, bts->location_area_code);
+	gsm48_generate_lai(lai, conn->network->country_code,
+			   conn->network->network_code,
+			   conn->bts->location_area_code);
 
 	if (conn->subscr->tmsi == GSM_RESERVED_TMSI) {
 		uint8_t mi[10];
@@ -506,7 +506,7 @@
 
 	DEBUGP(DMM, "-> LOCATION UPDATE ACCEPT\n");
 
-	rate_ctr_inc(&bts->network->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_RESP_ACCEPT]);
+	rate_ctr_inc(&conn->network->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_RESP_ACCEPT]);
 
 	return gsm48_conn_sendmsg(msg, conn, NULL);
 }
@@ -543,9 +543,7 @@
 static int mm_rx_id_resp(struct gsm_subscriber_connection *conn, struct msgb *msg)
 {
 	struct gsm48_hdr *gh = msgb_l3(msg);
-	struct gsm_lchan *lchan = msg->lchan;
-	struct gsm_bts *bts = lchan->ts->trx->bts;
-	struct gsm_network *net = bts->network;
+	struct gsm_network *net = conn->network;
 	uint8_t mi_type = gh->data[1] & GSM_MI_TYPE_MASK;
 	char mi_string[GSM48_MI_SIZE];
 
@@ -565,7 +563,7 @@
 				conn->subscr = subscr_create(net, mi_string);
 		}
 		if (!conn->subscr && conn->loc_operation) {
-			gsm0408_loc_upd_rej(conn, bts->network->reject_cause);
+			gsm0408_loc_upd_rej(conn, net->reject_cause);
 			release_loc_updating_req(conn, 1);
 			return 0;
 		}
@@ -592,11 +590,9 @@
 static void loc_upd_rej_cb(void *data)
 {
 	struct gsm_subscriber_connection *conn = data;
-	struct gsm_lchan *lchan = conn->lchan;
-	struct gsm_bts *bts = lchan->ts->trx->bts;
 
 	LOGP(DMM, LOGL_DEBUG, "Location Updating Request procedure timedout.\n");
-	gsm0408_loc_upd_rej(conn, bts->network->reject_cause);
+	gsm0408_loc_upd_rej(conn, conn->network->reject_cause);
 	release_loc_updating_req(conn, 1);
 }
 
@@ -620,7 +616,6 @@
 	struct gsm48_hdr *gh = msgb_l3(msg);
 	struct gsm48_loc_upd_req *lu;
 	struct gsm_subscriber *subscr = NULL;
-	struct gsm_bts *bts = conn->bts;
 	uint8_t mi_type;
 	char mi_string[GSM48_MI_SIZE];
 
@@ -637,13 +632,13 @@
 
 	switch (lu->type) {
 	case GSM48_LUPD_NORMAL:
-		rate_ctr_inc(&bts->network->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_TYPE_NORMAL]);
+		rate_ctr_inc(&conn->network->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_TYPE_NORMAL]);
 		break;
 	case GSM48_LUPD_IMSI_ATT:
-		rate_ctr_inc(&bts->network->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_TYPE_ATTACH]);
+		rate_ctr_inc(&conn->network->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_TYPE_ATTACH]);
 		break;
 	case GSM48_LUPD_PERIODIC:
-		rate_ctr_inc(&bts->network->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_TYPE_PERIODIC]);
+		rate_ctr_inc(&conn->network->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_TYPE_PERIODIC]);
 		break;
 	}
 
@@ -670,12 +665,11 @@
 		conn->loc_operation->waiting_for_imei = 1;
 
 		/* look up subscriber based on IMSI, create if not found */
-		subscr = subscr_get_by_imsi(bts->network->subscr_group, mi_string);
+		subscr = subscr_get_by_imsi(conn->network->subscr_group, mi_string);
 		if (!subscr)
-			subscr = subscr_create(bts->network, mi_string);
-
+			subscr = subscr_create(conn->network, mi_string);
 		if (!subscr) {
-			gsm0408_loc_upd_rej(conn, bts->network->reject_cause);
+			gsm0408_loc_upd_rej(conn, conn->network->reject_cause);
 			release_loc_updating_req(conn, 0);
 			return 0;
 		}
@@ -683,7 +677,7 @@
 	case GSM_MI_TYPE_TMSI:
 		DEBUGPC(DMM, "\n");
 		/* look up the subscriber based on TMSI, request IMSI if it fails */
-		subscr = subscr_get_by_tmsi(bts->network->subscr_group,
+		subscr = subscr_get_by_tmsi(conn->network->subscr_group,
 					    tmsi_from_string(mi_string));
 		if (!subscr) {
 			/* send IDENTITY REQUEST message to get IMSI */
@@ -738,7 +732,7 @@
 {
 	struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 MM INF");
 	struct gsm48_hdr *gh;
-	struct gsm_network *net = conn->bts->network;
+	struct gsm_network *net = conn->network;
 	struct gsm_bts *bts = conn->bts;
 	uint8_t *ptr8;
 	int name_len, name_pad;
@@ -973,7 +967,7 @@
 	uint8_t mi_type;
 	char mi_string[GSM48_MI_SIZE];
 
-	struct gsm_bts *bts = conn->bts;
+	struct gsm_network *network = conn->network;
 	struct gsm_subscriber *subscr;
 	struct gsm48_hdr *gh = msgb_l3(msg);
 	struct gsm48_service_request *req =
@@ -1004,13 +998,13 @@
 		DEBUGPC(DMM, "serv_type=0x%02x MI(%s)=%s\n",
 			req->cm_service_type, gsm48_mi_type_name(mi_type),
 			mi_string);
-		subscr = subscr_get_by_imsi(bts->network->subscr_group,
+		subscr = subscr_get_by_imsi(network->subscr_group,
 					    mi_string);
 	} else if (mi_type == GSM_MI_TYPE_TMSI) {
 		DEBUGPC(DMM, "serv_type=0x%02x MI(%s)=%s\n",
 			req->cm_service_type, gsm48_mi_type_name(mi_type),
 			mi_string);
-		subscr = subscr_get_by_tmsi(bts->network->subscr_group,
+		subscr = subscr_get_by_tmsi(network->subscr_group,
 				tmsi_from_string(mi_string));
 	} else {
 		DEBUGPC(DMM, "mi_type is not expected: %d\n", mi_type);
@@ -1020,7 +1014,7 @@
 
 	osmo_signal_dispatch(SS_SUBSCR, S_SUBSCR_IDENTITY, (classmark2 + classmark2_len));
 
-	if (is_siemens_bts(bts))
+	if (is_siemens_bts(conn->bts))
 		send_siemens_mrpci(msg->lchan, classmark2-1);
 
 
@@ -1051,7 +1045,7 @@
 
 static int gsm48_rx_mm_imsi_detach_ind(struct gsm_subscriber_connection *conn, struct msgb *msg)
 {
-	struct gsm_bts *bts = conn->bts;
+	struct gsm_network *network = conn->network;
 	struct gsm48_hdr *gh = msgb_l3(msg);
 	struct gsm48_imsi_detach_ind *idi =
 				(struct gsm48_imsi_detach_ind *) gh->data;
@@ -1063,17 +1057,17 @@
 	DEBUGP(DMM, "IMSI DETACH INDICATION: MI(%s)=%s",
 		gsm48_mi_type_name(mi_type), mi_string);
 
-	rate_ctr_inc(&bts->network->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_TYPE_DETACH]);
+	rate_ctr_inc(&network->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_TYPE_DETACH]);
 
 	switch (mi_type) {
 	case GSM_MI_TYPE_TMSI:
 		DEBUGPC(DMM, "\n");
-		subscr = subscr_get_by_tmsi(bts->network->subscr_group,
+		subscr = subscr_get_by_tmsi(network->subscr_group,
 					    tmsi_from_string(mi_string));
 		break;
 	case GSM_MI_TYPE_IMSI:
 		DEBUGPC(DMM, "\n");
-		subscr = subscr_get_by_imsi(bts->network->subscr_group,
+		subscr = subscr_get_by_imsi(network->subscr_group,
 					    mi_string);
 		break;
 	case GSM_MI_TYPE_IMEI:
@@ -1087,7 +1081,7 @@
 	}
 
 	if (subscr) {
-		subscr_update(subscr, bts,
+		subscr_update(subscr, conn->bts,
 			      GSM_SUBSCRIBER_UPDATE_DETACHED);
 		DEBUGP(DMM, "Subscriber: %s\n", subscr_name(subscr));
 
@@ -1119,7 +1113,7 @@
 {
 	struct gsm48_hdr *gh = msgb_l3(msg);
 	struct gsm48_auth_resp *ar = (struct gsm48_auth_resp*) gh->data;
-	struct gsm_network *net = conn->bts->network;
+	struct gsm_network *net = conn->network;
 
 	DEBUGP(DMM, "MM AUTHENTICATION RESPONSE (sres = %s): ",
 		osmo_hexdump(ar->sres, 4));
@@ -1200,7 +1194,6 @@
 /* Receive a PAGING RESPONSE message from the MS */
 static int gsm48_rx_rr_pag_resp(struct gsm_subscriber_connection *conn, struct msgb *msg)
 {
-	struct gsm_bts *bts = conn->bts;
 	struct gsm48_hdr *gh = msgb_l3(msg);
 	struct gsm48_pag_resp *resp;
 	uint8_t *classmark2_lv = gh->data + 1;
@@ -1217,11 +1210,11 @@
 
 	switch (mi_type) {
 	case GSM_MI_TYPE_TMSI:
-		subscr = subscr_get_by_tmsi(bts->network->subscr_group,
+		subscr = subscr_get_by_tmsi(conn->network->subscr_group,
 					    tmsi_from_string(mi_string));
 		break;
 	case GSM_MI_TYPE_IMSI:
-		subscr = subscr_get_by_imsi(bts->network->subscr_group,
+		subscr = subscr_get_by_imsi(conn->network->subscr_group,
 					    mi_string);
 		break;
 	}
@@ -3595,7 +3588,7 @@
 		DEBUGP(DCC, "Unknown transaction ID %x, "
 			"creating new trans.\n", transaction_id);
 		/* Create transaction */
-		trans = trans_alloc(conn->bts->network, conn->subscr,
+		trans = trans_alloc(conn->network, conn->subscr,
 				    GSM48_PDISC_CC,
 				    transaction_id, new_callref++);
 		if (!trans) {
diff --git a/openbsc/src/libmsc/gsm_04_11.c b/openbsc/src/libmsc/gsm_04_11.c
index 08d8fdf..3a2effe 100644
--- a/openbsc/src/libmsc/gsm_04_11.c
+++ b/openbsc/src/libmsc/gsm_04_11.c
@@ -309,20 +309,20 @@
 #endif
 
 	/* determine gsms->receiver based on dialled number */
-	gsms->receiver = subscr_get_by_extension(conn->bts->network->subscr_group,
+	gsms->receiver = subscr_get_by_extension(conn->network->subscr_group,
 						 gsms->dst.addr);
 	if (!gsms->receiver) {
 #ifdef BUILD_SMPP
 		/* Avoid a second look-up */
 		if (smpp_first) {
-			rate_ctr_inc(&conn->bts->network->msc_ctrs->ctr[MSC_CTR_SMS_NO_RECEIVER]);
+			rate_ctr_inc(&conn->network->msc_ctrs->ctr[MSC_CTR_SMS_NO_RECEIVER]);
 			return 1; /* cause 1: unknown subscriber */
 		}
 
 		rc = smpp_try_deliver(gsms, conn);
 		if (rc == 1) {
 			rc = 1; /* cause 1: unknown subscriber */
-			rate_ctr_inc(&conn->bts->network->msc_ctrs->ctr[MSC_CTR_SMS_NO_RECEIVER]);
+			rate_ctr_inc(&conn->network->msc_ctrs->ctr[MSC_CTR_SMS_NO_RECEIVER]);
 		} else if (rc < 0) {
 	 		LOGP(DLSMS, LOGL_ERROR, "%s: SMS delivery error: %d.",
 			     subscr_name(conn->subscr), rc);
@@ -333,7 +333,7 @@
 		}
 #else
 		rc = 1; /* cause 1: unknown subscriber */
-		rate_ctr_inc(&conn->bts->network->msc_ctrs->ctr[MSC_CTR_SMS_NO_RECEIVER]);
+		rate_ctr_inc(&conn->network->msc_ctrs->ctr[MSC_CTR_SMS_NO_RECEIVER]);
 #endif
 		return rc;
 	}
@@ -374,7 +374,7 @@
 	uint8_t address_lv[12]; /* according to 03.40 / 9.1.2.5 */
 	int rc = 0;
 
-	rate_ctr_inc(&conn->bts->network->msc_ctrs->ctr[MSC_CTR_SMS_SUBMITTED]);
+	rate_ctr_inc(&conn->network->msc_ctrs->ctr[MSC_CTR_SMS_SUBMITTED]);
 
 	gsms = sms_alloc();
 	if (!gsms)
@@ -616,7 +616,7 @@
 static int gsm411_rx_rp_error(struct msgb *msg, struct gsm_trans *trans,
 			      struct gsm411_rp_hdr *rph)
 {
-	struct gsm_network *net = trans->conn->bts->network;
+	struct gsm_network *net = trans->conn->network;
 	struct gsm_sms *sms = trans->sms.sms;
 	uint8_t cause_len = rph->data[0];
 	uint8_t cause = rph->data[1];
@@ -816,7 +816,7 @@
 
 	if (!trans) {
 		DEBUGP(DLSMS, " -> (new transaction)\n");
-		trans = trans_alloc(conn->bts->network, conn->subscr,
+		trans = trans_alloc(conn->network, conn->subscr,
 				    GSM48_PDISC_SMS,
 				    transaction_id, new_callref++);
 		if (!trans) {
@@ -878,7 +878,7 @@
 	int rc;
 
 	transaction_id =
-		trans_assign_trans_id(conn->bts->network, conn->subscr,
+		trans_assign_trans_id(conn->network, conn->subscr,
 				      GSM48_PDISC_SMS, 0);
 	if (transaction_id == -1) {
 		LOGP(DLSMS, LOGL_ERROR, "No available transaction ids\n");
@@ -891,7 +891,7 @@
 	DEBUGP(DLSMS, "%s()\n", __func__);
 
 	/* FIXME: allocate transaction with message reference */
-	trans = trans_alloc(conn->bts->network, conn->subscr,
+	trans = trans_alloc(conn->network, conn->subscr,
 			    GSM48_PDISC_SMS,
 			    transaction_id, new_callref++);
 	if (!trans) {
@@ -943,7 +943,7 @@
 
 	DEBUGP(DLSMS, "TX: SMS DELIVER\n");
 
-	rate_ctr_inc(&conn->bts->network->msc_ctrs->ctr[MSC_CTR_SMS_DELIVERED]);
+	rate_ctr_inc(&conn->network->msc_ctrs->ctr[MSC_CTR_SMS_DELIVERED]);
 	db_sms_inc_deliver_attempts(trans->sms.sms);
 
 	return gsm411_rp_sendmsg(&trans->sms.smr_inst, msg,
@@ -1037,7 +1037,7 @@
 	struct gsm_network *net;
 	struct gsm_trans *trans, *tmp;
 
-	net = conn->bts->network;
+	net = conn->network;
 
 	llist_for_each_entry_safe(trans, tmp, &net->trans_list, entry) {
 		struct gsm_sms *sms;
diff --git a/openbsc/src/libmsc/rrlp.c b/openbsc/src/libmsc/rrlp.c
index 161456a..e695daa 100644
--- a/openbsc/src/libmsc/rrlp.c
+++ b/openbsc/src/libmsc/rrlp.c
@@ -40,7 +40,7 @@
 
 static int send_rrlp_req(struct gsm_subscriber_connection *conn)
 {
-	struct gsm_network *net = conn->bts->network;
+	struct gsm_network *net = conn->network;
 	const uint8_t *req;
 
 	switch (net->rrlp.mode) {
diff --git a/openbsc/src/libmsc/transaction.c b/openbsc/src/libmsc/transaction.c
index a750362..dba4bed 100644
--- a/openbsc/src/libmsc/transaction.c
+++ b/openbsc/src/libmsc/transaction.c
@@ -37,7 +37,7 @@
 				   uint8_t proto, uint8_t trans_id)
 {
 	struct gsm_trans *trans;
-	struct gsm_network *net = conn->bts->network;
+	struct gsm_network *net = conn->network;
 	struct gsm_subscriber *subscr = conn->subscr;
 
 	llist_for_each_entry(trans, &net->trans_list, entry) {
@@ -155,7 +155,7 @@
 {
 	struct gsm_trans *trans;
 
-	llist_for_each_entry(trans, &conn->bts->network->trans_list, entry)
+	llist_for_each_entry(trans, &conn->network->trans_list, entry)
 		if (trans->conn == conn)
 			return 1;