diff --git a/src/bts.cpp b/src/bts.cpp
index d027993..8d4f494 100644
--- a/src/bts.cpp
+++ b/src/bts.cpp
@@ -884,13 +884,21 @@
 	int rc;
 
 	if (request->ID.UnionType) {
-		struct gprs_rlcmac_ul_tbf *ul_tbf;
-		struct gprs_rlcmac_dl_tbf *dl_tbf;
+		struct gprs_rlcmac_ul_tbf *ul_tbf = NULL;
+		struct gprs_rlcmac_dl_tbf *dl_tbf = NULL;
 		uint32_t tlli = request->ID.u.TLLI;
 		uint8_t ms_class = 0;
 		uint8_t ta;
 
-		ul_tbf = bts()->ul_tbf_by_tlli(tlli);
+		GprsMs *ms = bts()->ms_by_tlli(tlli);
+		/* Keep the ms, even if it gets idle temporarily */
+		GprsMs::Guard guard(ms);
+
+		if (ms) {
+			ul_tbf = ms->ul_tbf();
+			dl_tbf = ms->dl_tbf();
+		}
+
 		if (ul_tbf) {
 			LOGP(DRLCMACUL, LOGL_NOTICE, "Got RACH from "
 				"TLLI=0x%08x while %s still "
@@ -900,7 +908,7 @@
 			ul_tbf = NULL;
 		}
 
-		if ((dl_tbf = bts()->dl_tbf_by_tlli(tlli))) {
+		if (dl_tbf) {
 			LOGP(DRLCMACUL, LOGL_NOTICE, "Got RACH from "
 				"TLLI=0x%08x while %s still exists. "
 				"Killing pending DL TBF\n", tlli,
diff --git a/src/bts.h b/src/bts.h
index 1277846..cdf5ec3 100644
--- a/src/bts.h
+++ b/src/bts.h
@@ -32,6 +32,7 @@
 #include "sba.h"
 #include "ta.h"
 #include "tbf.h"
+#include "gprs_ms_storage.h"
 #endif
 
 #include <stdint.h>
@@ -220,6 +221,9 @@
 	void trigger_dl_ass(gprs_rlcmac_dl_tbf *tbf, gprs_rlcmac_tbf *old_tbf, const char *imsi);
 	void snd_dl_ass(gprs_rlcmac_tbf *tbf, uint8_t poll, const char *imsi);
 
+	GprsMsStorage &ms_store();
+	GprsMs *ms_by_tlli(uint32_t tlli, uint32_t old_tlli = 0);
+
 	/*
 	 * Statistics
 	 */
@@ -257,6 +261,8 @@
 	gprs_rlcmac_tbf *tbf_by_tlli(uint32_t tlli, enum gprs_rlcmac_tbf_direction dir);
 	gprs_rlcmac_tbf *tbf_by_tfi(uint8_t tfi, uint8_t trx, enum gprs_rlcmac_tbf_direction dir);
 
+	GprsMsStorage m_ms_store;
+
 private:
 	/* disable copying to avoid slicing */
 	BTS(const BTS&);
@@ -278,6 +284,16 @@
 	return &m_sba;
 }
 
+inline GprsMsStorage &BTS::ms_store()
+{
+	return m_ms_store;
+}
+
+inline GprsMs *BTS::ms_by_tlli(uint32_t tlli, uint32_t old_tlli)
+{
+	return ms_store().get_ms(tlli, old_tlli);
+}
+
 inline BTS *gprs_rlcmac_pdch::bts() const
 {
 	return trx->bts;
diff --git a/src/tbf.cpp b/src/tbf.cpp
index 89072e4..799699a 100644
--- a/src/tbf.cpp
+++ b/src/tbf.cpp
@@ -94,8 +94,7 @@
 void gprs_rlcmac_tbf::update_ms(uint32_t tlli)
 {
 	if (!ms())
-		/* TODO: access the container instead when that is implemented */
-		set_ms(new GprsMs(tlli));
+		set_ms(bts->ms_store().get_or_create_ms(tlli));
 	else
 		ms()->set_tlli(tlli);
 }
@@ -236,7 +235,14 @@
 	if (direction != GPRS_RLCMAC_DL_TBF)
 		return -EINVAL;
 
-	ul_tbf = bts->ul_tbf_by_tlli(m_tlli);
+	if (ms()) {
+		ul_tbf = ms()->ul_tbf();
+	} else if (is_tlli_valid()) {
+		LOGP(DRLCMAC, LOGL_NOTICE,
+			"Using ul_tbf_by_tlli() since there is no MS object for "
+			"TLLI 0x%08x\n", m_tlli);
+		ul_tbf = bts->ul_tbf_by_tlli(m_tlli);
+	}
 
 	tbf_unlink_pdch(this);
 	rc = bts_data->alloc_algorithm(bts_data, ul_tbf, this, bts_data->alloc_algorithm_curst, 0);
@@ -840,10 +846,12 @@
 
 int gprs_rlcmac_tbf::extract_tlli(const uint8_t *data, const size_t len)
 {
-	struct gprs_rlcmac_tbf *dl_tbf, *ul_tbf;
+	struct gprs_rlcmac_tbf *dl_tbf = NULL;
+	struct gprs_rlcmac_tbf *ul_tbf = NULL;
 	struct rlc_ul_header *rh = (struct rlc_ul_header *)data;
 	uint32_t new_tlli;
 	int rc;
+	GprsMs *old_ms;
 
 	/* no TLLI yet */
 	if (!rh->ti) {
@@ -858,11 +866,21 @@
 		"of UL DATA TFI=%d.\n", rh->tfi);
 		return 0;
 	}
+
+	old_ms = bts->ms_by_tlli(new_tlli);
+	if (old_ms) {
+		/* Get them before calling set_ms() */
+		dl_tbf = old_ms->dl_tbf();
+		ul_tbf = old_ms->ul_tbf();
+
+		set_ms(old_ms);
+	}
+
 	update_tlli(new_tlli);
 	update_ms(new_tlli);
 	LOGP(DRLCMACUL, LOGL_INFO, "Decoded premier TLLI=0x%08x of "
 		"UL DATA TFI=%d.\n", tlli(), rh->tfi);
-	if ((dl_tbf = bts->dl_tbf_by_tlli(tlli()))) {
+	if (dl_tbf) {
 		LOGP(DRLCMACUL, LOGL_NOTICE, "Got RACH from "
 			"TLLI=0x%08x while %s still exists. "
 			"Killing pending DL TBF\n", tlli(),
@@ -870,9 +888,7 @@
 		tbf_free(dl_tbf);
 		dl_tbf = NULL;
 	}
-	/* ul_tbf_by_tlli will not find your TLLI, because it is not
-	 * yet marked valid */
-	if ((ul_tbf = bts->ul_tbf_by_tlli(tlli()))) {
+	if (ul_tbf) {
 		LOGP(DRLCMACUL, LOGL_NOTICE, "Got RACH from "
 			"TLLI=0x%08x while %s still exists. "
 			"Killing pending UL TBF\n", tlli(),
diff --git a/src/tbf_dl.cpp b/src/tbf_dl.cpp
index aec1535..5cdac5f 100644
--- a/src/tbf_dl.cpp
+++ b/src/tbf_dl.cpp
@@ -137,8 +137,11 @@
 static struct gprs_rlcmac_dl_tbf *tbf_lookup_dl(BTS *bts,
 					const uint32_t tlli, const char *imsi)
 {
-	/* TODO: look up by IMSI first, then tlli, then old_tlli */
-	return bts->dl_tbf_by_tlli(tlli);
+	GprsMs *ms = bts->ms_store().get_ms(tlli, 0, imsi);
+	if (!ms)
+		return NULL;
+
+	return ms->dl_tbf();
 }
 
 static int tbf_new_dl_assignment(struct gprs_rlcmac_bts *bts,
@@ -148,15 +151,19 @@
 {
 	uint8_t trx, ta, ss;
 	int8_t use_trx;
-	struct gprs_rlcmac_ul_tbf *ul_tbf, *old_ul_tbf;
+	struct gprs_rlcmac_ul_tbf *ul_tbf = NULL, *old_ul_tbf;
 	struct gprs_rlcmac_dl_tbf *dl_tbf = NULL;
 	int8_t tfi; /* must be signed */
 	int rc;
+	GprsMs *ms;
 
 	/* check for uplink data, so we copy our informations */
 #warning "Do the same look up for IMSI, TLLI and OLD_TLLI"
 #warning "Refactor the below lines... into a new method"
-	ul_tbf = bts->bts->ul_tbf_by_tlli(tlli);
+	ms = bts->bts->ms_store().get_ms(tlli, 0, imsi);
+	if (ms)
+		ul_tbf = ms->ul_tbf();
+
 	if (ul_tbf && ul_tbf->m_contention_resolution_done
 	 && !ul_tbf->m_final_ack_sent) {
 		use_trx = ul_tbf->trx->trx_no;