diff --git a/src/bts.cpp b/src/bts.cpp
index 3b27676..07ea77c 100644
--- a/src/bts.cpp
+++ b/src/bts.cpp
@@ -1007,7 +1007,7 @@
 		     "SBFn=%u TRX=%u TS=%u\n", sb_fn, pdch->trx->trx_no, pdch->ts_no);
 		bts_do_rate_ctr_inc(bts, CTR_IMMEDIATE_ASSIGN_UL_TBF_TWO_PHASE);
 	} else {
-		GprsMs *ms = bts_alloc_ms(bts);
+		GprsMs *ms = ms_alloc(bts);
 		ms_set_egprs_ms_class(ms, chan_req.egprs_mslot_class);
 		tbf = ms_new_ul_tbf_assigned_agch(ms);
 		if (!tbf) {
@@ -1198,36 +1198,6 @@
 	}
 }
 
-static void bts_ms_idle_cb(struct GprsMs *ms)
-{
-	bts_stat_item_dec(ms->bts, STAT_MS_PRESENT);
-	if (ms_is_idle(ms))
-		talloc_free(ms);
-}
-
-static void bts_ms_active_cb(struct GprsMs *ms)
-{
-	/* Nothing to do */
-}
-
-GprsMs *bts_alloc_ms(struct gprs_rlcmac_bts* bts)
-{
-	struct GprsMs *ms;
-
-	static struct gpr_ms_callback bts_ms_cb = {
-		.ms_idle = bts_ms_idle_cb,
-		.ms_active = bts_ms_active_cb,
-	};
-
-	ms = ms_alloc(bts);
-
-	ms_set_callback(ms, &bts_ms_cb);
-	ms_set_timeout(ms, osmo_tdef_get(bts->pcu->T_defs, -2030, OSMO_TDEF_S, -1));
-
-	bts_stat_item_inc(bts, STAT_MS_PRESENT);
-	return ms;
-}
-
 struct GprsMs *bts_get_ms(const struct gprs_rlcmac_bts *bts, uint32_t tlli, uint32_t old_tlli,
 			  const char *imsi)
 {
diff --git a/src/bts.h b/src/bts.h
index 5644b44..7dd8547 100644
--- a/src/bts.h
+++ b/src/bts.h
@@ -285,7 +285,6 @@
 	struct osmo_mobile_identity mi_imsi;
 };
 
-struct GprsMs *bts_alloc_ms(struct gprs_rlcmac_bts *bts);
 int bts_add_paging(struct gprs_rlcmac_bts *bts, const struct paging_req_cs *req, struct GprsMs *ms);
 
 uint32_t bts_rfn_to_fn(const struct gprs_rlcmac_bts *bts, uint32_t rfn);
diff --git a/src/gprs_ms.c b/src/gprs_ms.c
index 3e95103..b9a1b76 100644
--- a/src/gprs_ms.c
+++ b/src/gprs_ms.c
@@ -63,7 +63,8 @@
 
 void gprs_default_cb_ms_idle(struct GprsMs *ms)
 {
-	talloc_free(ms);
+	if (ms_is_idle(ms))
+		talloc_free(ms);
 }
 
 void gprs_default_cb_ms_active(struct GprsMs *ms)
@@ -111,6 +112,7 @@
 	talloc_set_destructor(ms, ms_talloc_destructor);
 
 	llist_add(&ms->list, &bts->ms_list);
+	bts_stat_item_inc(bts, STAT_MS_PRESENT);
 
 	ms->bts = bts;
 	ms->cb = gprs_default_cb;
@@ -147,6 +149,8 @@
 	if (!ms->ctrs)
 		goto free_ret;
 
+	ms_set_timeout(ms, osmo_tdef_get(bts->pcu->T_defs, -2030, OSMO_TDEF_S, -1));
+
 	return ms;
 free_ret:
 	talloc_free(ms);
@@ -159,6 +163,7 @@
 
 	LOGPMS(ms, DRLCMAC, LOGL_INFO, "Destroying MS object\n");
 
+	bts_stat_item_dec(ms->bts, STAT_MS_PRESENT);
 	llist_del(&ms->list);
 
 	ms_set_reserved_slots(ms, NULL, 0, 0);
diff --git a/src/pdch.cpp b/src/pdch.cpp
index 43b3936..1c39ceb 100644
--- a/src/pdch.cpp
+++ b/src/pdch.cpp
@@ -665,7 +665,7 @@
 		uint32_t tlli = request->ID.u.TLLI;
 		ms = bts_get_ms_by_tlli(bts, tlli, GSM_RESERVED_TMSI);
 		if (!ms) {
-			ms = bts_alloc_ms(bts);
+			ms = ms_alloc(bts);
 			ms_set_tlli(ms, tlli);
 		}
 	} else if (request->ID.u.Global_TFI.UnionType) { /* ID_TYPE = DL_TFI */
@@ -857,7 +857,7 @@
 	if (!ms) {
 		LOGPDCH(this, DRLCMAC, LOGL_NOTICE, "MS send measurement "
 			"but TLLI 0x%08x is unknown\n", report->TLLI);
-		ms = bts_alloc_ms(bts());
+		ms = ms_alloc(bts());
 		ms_set_tlli(ms, report->TLLI);
 	}
 	if ((poll = pdch_ulc_get_node(ulc, fn))) {
diff --git a/src/tbf_dl.cpp b/src/tbf_dl.cpp
index cca059a..cdd703c 100644
--- a/src/tbf_dl.cpp
+++ b/src/tbf_dl.cpp
@@ -216,7 +216,7 @@
 	}
 
 	if (!ms)
-		ms = bts_alloc_ms(bts);
+		ms = ms_alloc(bts);
 	if (imsi)
 		ms_set_imsi(ms, imsi);
 	ms_confirm_tlli(ms, tlli);
diff --git a/tests/alloc/AllocTest.cpp b/tests/alloc/AllocTest.cpp
index 4497fbd..cf1bba7 100644
--- a/tests/alloc/AllocTest.cpp
+++ b/tests/alloc/AllocTest.cpp
@@ -135,7 +135,7 @@
 	 * least this part is working okay.
 	 */
 	for (i = 0; i < (int)ARRAY_SIZE(tbfs); ++i) {
-		ms = bts_alloc_ms(bts);
+		ms = ms_alloc(bts);
 		tbfs[i] = tbf_alloc(bts, ms, dir, -1, 0);
 		if (tbfs[i] == NULL)
 			break;
@@ -155,7 +155,7 @@
 		if (tbfs[i])
 			tbf_free(tbfs[i]);
 
-	ms = bts_alloc_ms(bts);
+	ms = ms_alloc(bts);
 	tbfs[0] = tbf_alloc(bts, ms, dir, -1, 0);
 	OSMO_ASSERT(tbfs[0]);
 	tbf_free(tbfs[0]);
@@ -221,7 +221,7 @@
 
 	enable_ts_on_bts(bts, ts0, ts1, ts2, ts3, ts4, ts5, ts6, ts7);
 
-	ms = bts_alloc_ms(bts);
+	ms = ms_alloc(bts);
 	ms_set_ms_class(ms, ms_class);
 	/* Avoid delaying free to avoid tons of to-be-freed ms objects queuing */
 	ms_set_timeout(ms, 0);
@@ -264,7 +264,7 @@
 
 	enable_ts_on_bts(bts, ts0, ts1, ts2, ts3, ts4, ts5, ts6, ts7);
 
-	ms = bts_alloc_ms(bts);
+	ms = ms_alloc(bts);
 	ms_set_ms_class(ms, ms_class);
 	/* Avoid delaying free to avoid tons of to-be-freed ms objects queuing */
 	ms_set_timeout(ms, 0);
@@ -315,7 +315,7 @@
 
 	tfi = bts_tfi_find_free(bts, GPRS_RLCMAC_UL_TBF, &trx_no, -1);
 	OSMO_ASSERT(tfi >= 0);
-	ms = bts_alloc_ms(bts);
+	ms = ms_alloc(bts);
 	ms_set_ms_class(ms, ms_class);
 	/* Avoid delaying free to avoid tons of to-be-freed ms objects queuing */
 	ms_set_timeout(ms, 0);
@@ -561,7 +561,7 @@
 
 		ms = bts_get_ms_by_tlli(bts, tlli, GSM_RESERVED_TMSI);
 		if (!ms)
-			ms = bts_alloc_ms(bts);
+			ms = ms_alloc(bts);
 		ms_set_ms_class(ms, ms_class);
 		ms = alloc_tbfs(bts, ms, mode);
 		if (!ms)
@@ -770,7 +770,7 @@
 	trx->pdch[6].enable();
 	trx->pdch[7].enable();
 
-	ms = bts_alloc_ms(bts);
+	ms = ms_alloc(bts);
 	ms_set_ms_class(ms, ms_class);
 	ms_set_egprs_ms_class(ms, egprs_ms_class);
 	dl_tbf1 = dl_tbf_alloc(bts, ms, 0, false);
@@ -783,7 +783,7 @@
 	OSMO_ASSERT(numTs1 == 4);
 	printf("TBF1: numTs(%d)\n", numTs1);
 
-	ms = bts_alloc_ms(bts);
+	ms = ms_alloc(bts);
 	ms_set_ms_class(ms, ms_class);
 	ms_set_egprs_ms_class(ms, egprs_ms_class);
 	dl_tbf2 = dl_tbf_alloc(bts, ms, 0, false);
diff --git a/tests/app_info/AppInfoTest.cpp b/tests/app_info/AppInfoTest.cpp
index 1a4e660..ea84b20 100644
--- a/tests/app_info/AppInfoTest.cpp
+++ b/tests/app_info/AppInfoTest.cpp
@@ -90,11 +90,11 @@
 	trx->pdch[6].enable();
 	trx->pdch[7].enable();
 
-	ms1 = bts_alloc_ms(bts);
+	ms1 = ms_alloc(bts);
 	ms_set_ms_class(ms1, 10);
 	ms_set_egprs_ms_class(ms1, 11);
 	tbf1 = dl_tbf_alloc(bts, ms1, 0, false);
-	ms2 = bts_alloc_ms(bts);
+	ms2 = ms_alloc(bts);
 	ms_set_ms_class(ms2, 12);
 	ms_set_egprs_ms_class(ms2, 13);
 	tbf2 = dl_tbf_alloc(bts, ms2, 0, false);
@@ -162,7 +162,7 @@
 	bts = gprs_pcu_get_bts_by_nr(the_pcu, 0);
 	talloc_free(bts);
 
-	/* FIXME: talloc report disabled, because bts_alloc_ms(bts, ) in prepare_bts_with_two_dl_tbf_subscr() causes leak */
+	/* FIXME: talloc report disabled, because ms_alloc(bts, ) in prepare_bts_with_two_dl_tbf_subscr() causes leak */
 	/* talloc_report_full(tall_pcu_ctx, stderr); */
 	talloc_free(the_pcu);
 	talloc_free(tall_pcu_ctx);
diff --git a/tests/llc/LlcTest.cpp b/tests/llc/LlcTest.cpp
index 3c19787..ee227f9 100644
--- a/tests/llc/LlcTest.cpp
+++ b/tests/llc/LlcTest.cpp
@@ -52,7 +52,7 @@
 	the_pcu = gprs_pcu_alloc(tall_pcu_ctx);
 	the_pcu->vty.llc_codel_interval_msec = LLC_CODEL_DISABLE;
 	struct gprs_rlcmac_bts *bts = bts_alloc(the_pcu, 0);
-	struct GprsMs *ms = bts_alloc_ms(bts);
+	struct GprsMs *ms = ms_alloc(bts);
 	return ms_llc_queue(ms);
 }
 
@@ -235,7 +235,7 @@
 	/* DEFAULT should be resolved to GPRS_CODEL_SLOW_INTERVAL_MS 4000 */
 	#define GPRS_CODEL_SLOW_INTERVAL_MS 4000
 	struct gprs_rlcmac_bts *bts = bts_alloc(the_pcu, 0);
-	struct GprsMs *ms = bts_alloc_ms(bts);
+	struct GprsMs *ms = ms_alloc(bts);
 	gprs_llc_queue *queue = ms_llc_queue(ms);
 	unsigned int i;
 
@@ -297,7 +297,7 @@
 static void test_llc_merge()
 {
 	gprs_llc_queue *queue1 = prepare_queue();
-	struct GprsMs *ms = bts_alloc_ms(queue1->ms->bts);
+	struct GprsMs *ms = ms_alloc(queue1->ms->bts);
 	gprs_llc_queue *queue2 = ms_llc_queue(ms);
 	struct timespec expire_time = {0};
 
diff --git a/tests/ms/MsTest.cpp b/tests/ms/MsTest.cpp
index 84cb52e..a8febd0 100644
--- a/tests/ms/MsTest.cpp
+++ b/tests/ms/MsTest.cpp
@@ -380,7 +380,7 @@
 	if (ms)
 		return ms;
 
-	ms = bts_alloc_ms(bts);
+	ms = ms_alloc(bts);
 
 	if (dir == GPRS_RLCMAC_UL_TBF)
 		ms_set_tlli(ms, tlli);
diff --git a/tests/tbf/TbfTest.cpp b/tests/tbf/TbfTest.cpp
index d493e6c..0f0960a 100644
--- a/tests/tbf/TbfTest.cpp
+++ b/tests/tbf/TbfTest.cpp
@@ -122,7 +122,7 @@
 	/*
 	 * Make a uplink and downlink allocation
 	 */
-	ms = bts_alloc_ms(bts);
+	ms = ms_alloc(bts);
 	gprs_rlcmac_tbf *dl_tbf = dl_tbf_alloc(bts,
 						ms, 0, false);
 	OSMO_ASSERT(dl_tbf != NULL);
@@ -205,7 +205,7 @@
 	GprsMs *ms;
 	gprs_rlcmac_dl_tbf *dl_tbf;
 
-	ms = bts_alloc_ms(bts);
+	ms = ms_alloc(bts);
 	ms_set_ms_class(ms, ms_class);
 	ms_set_egprs_ms_class(ms, egprs_ms_class);
 
@@ -2346,7 +2346,7 @@
 	gprs_bssgp_init(bts, 4234, 4234, 1, 1, false, 0, 0, 0);
 
 	/* Does no support EGPRS */
-	ms = bts_alloc_ms(bts);
+	ms = ms_alloc(bts);
 	ms_set_ms_class(ms, ms_class);
 	dl_tbf = dl_tbf_alloc(bts, ms, 0, false);
 
@@ -2355,7 +2355,7 @@
 	/* EGPRS-only */
 
 	/* Does support EGPRS */
-	ms = bts_alloc_ms(bts);
+	ms = ms_alloc(bts);
 	ms_set_ms_class(ms, ms_class);
 	ms_set_egprs_ms_class(ms, ms_class);
 	dl_tbf = dl_tbf_alloc(bts, ms, 0, false);
@@ -2397,7 +2397,7 @@
 	/* EGPRS-only */
 
 	/* Does support EGPRS */
-	ms = bts_alloc_ms(bts);
+	ms = ms_alloc(bts);
 	ms_set_ms_class(ms, ms_class);
 	ms_set_egprs_ms_class(ms, ms_class);
 	dl_tbf = dl_tbf_alloc(bts, ms, 0, true);
@@ -2476,7 +2476,7 @@
 	trx0->pdch[2].enable();
 	trx0->pdch[3].enable();
 
-	second_ms = bts_alloc_ms(bts);
+	second_ms = ms_alloc(bts);
 	ms_set_tlli(second_ms, new_tlli);
 	ul_tbf = ul_tbf_alloc(bts, second_ms, 0, true);
 	OSMO_ASSERT(ul_tbf != NULL);
@@ -3335,7 +3335,7 @@
 
 	int rc = 0;
 
-	ms = bts_alloc_ms(bts);
+	ms = ms_alloc(bts);
 	ms_set_tlli(ms, tlli);
 	ul_tbf = ms_new_ul_tbf_rejected_pacch(ms, pdch);
 
diff --git a/tests/types/TypesTest.cpp b/tests/types/TypesTest.cpp
index 94fc980..91b7ce4 100644
--- a/tests/types/TypesTest.cpp
+++ b/tests/types/TypesTest.cpp
@@ -688,7 +688,7 @@
 	the_pcu->alloc_algorithm = alloc_algorithm_a;
 	bts->trx[0].pdch[4].enable();
 
-	GprsMs *ms = bts_alloc_ms(bts);
+	GprsMs *ms = ms_alloc(bts);
 	ms_set_ms_class(ms, 1);
 	ms_set_egprs_ms_class(ms, 1);
 	struct gprs_rlcmac_ul_tbf *tbf = ul_tbf_alloc(bts, ms, 0, true);
@@ -781,7 +781,7 @@
 	the_pcu->alloc_algorithm = alloc_algorithm_a;
 	bts->trx[0].pdch[2].enable();
 	bts->trx[0].pdch[3].enable();
-	GprsMs *ms = bts_alloc_ms(bts);
+	GprsMs *ms = ms_alloc(bts);
 	ms_set_ms_class(ms, 1);
 
 	struct gprs_rlcmac_tbf *tbf = dl_tbf_alloc(bts, ms, 0, false);
@@ -808,7 +808,7 @@
 	bts->trx[0].pdch[4].enable();
 	bts->trx[0].pdch[5].enable();
 
-	GprsMs *ms = bts_alloc_ms(bts);
+	GprsMs *ms = ms_alloc(bts);
 	ms_set_ms_class(ms, 1);
 	struct gprs_rlcmac_tbf *tbf = ul_tbf_alloc(bts, ms, 0, false);
 	static uint8_t res[] = { 0x06,
@@ -851,7 +851,7 @@
 	bts->trx[0].pdch[1].enable();
 	bts->trx[0].pdch[2].enable();
 
-	GprsMs *ms = bts_alloc_ms(bts);
+	GprsMs *ms = ms_alloc(bts);
 	ms_set_ms_class(ms, 1);
 	ms_set_egprs_ms_class(ms, 1);
 	struct gprs_rlcmac_tbf *tbf = ul_tbf_alloc(bts, ms, 0, false);