diff --git a/src/tbf.cpp b/src/tbf.cpp
index 90ee4cf..305a549 100644
--- a/src/tbf.cpp
+++ b/src/tbf.cpp
@@ -187,6 +187,18 @@
         tbf_ul_egprs_ctr_description,
 };
 
+static void setup_egprs_mode(gprs_rlcmac_bts *bts, GprsMs *ms)
+{
+	if (mcs_is_edge_gmsk(mcs_get_egprs_by_num(bts->max_mcs_ul)) &&
+		mcs_is_edge_gmsk(mcs_get_egprs_by_num(bts->max_mcs_dl)) &&
+		ms->mode() != EGPRS)
+	{
+		ms->set_mode(EGPRS_GMSK);
+	} else {
+		ms->set_mode(EGPRS);
+	}
+}
+
 gprs_rlcmac_tbf::Meas::Meas() :
 	rssi_sum(0),
 	rssi_num(0)
@@ -194,7 +206,7 @@
 	timespecclear(&rssi_tv);
 }
 
-gprs_rlcmac_tbf::gprs_rlcmac_tbf(BTS *bts_, gprs_rlcmac_tbf_direction dir) :
+gprs_rlcmac_tbf::gprs_rlcmac_tbf(BTS *bts_, GprsMs *ms, gprs_rlcmac_tbf_direction dir) :
 	state_flags(0),
 	direction(dir),
 	trx(NULL),
@@ -211,9 +223,7 @@
 	m_tfi(0),
 	m_created_ts(0),
 	m_ctrs(NULL),
-	m_ms(NULL),
-	m_ta(GSM48_TA_INVALID),
-	m_ms_class(0),
+	m_ms(ms),
 	state(GPRS_RLCMAC_NULL),
 	dl_ass_state(GPRS_RLCMAC_DL_ASS_NONE),
 	ul_ass_state(GPRS_RLCMAC_UL_ASS_NONE),
@@ -286,29 +296,17 @@
 
 uint8_t gprs_rlcmac_tbf::ta() const
 {
-	return m_ms ? m_ms->ta() : m_ta;
+	return m_ms->ta();
 }
 
 void gprs_rlcmac_tbf::set_ta(uint8_t ta)
 {
-	if (ms())
-		ms()->set_ta(ta);
-
-	if (gsm48_ta_is_valid(ta))
-		m_ta = ta;
+	ms()->set_ta(ta);
 }
 
 uint8_t gprs_rlcmac_tbf::ms_class() const
 {
-	return m_ms ? m_ms->ms_class() : m_ms_class;
-}
-
-void gprs_rlcmac_tbf::set_ms_class(uint8_t ms_class_)
-{
-	if (ms())
-		ms()->set_ms_class(ms_class_);
-
-	m_ms_class = ms_class_;
+	return m_ms->ms_class();
 }
 
 enum CodingScheme gprs_rlcmac_tbf::current_cs() const
@@ -346,11 +344,6 @@
 		return;
 
 	if (m_ms) {
-		/* Save the TA locally. This will also be called, if the MS
-		 * object detaches itself from the TBF, for instance if
-		 * attach_tbf() is called */
-		m_ta = m_ms->ta();
-
 		m_ms->detach_tbf(this);
 	}
 
@@ -916,49 +909,46 @@
 		LOGPTBF(this, LOGL_ERROR, "Poll Timeout, but no event!\n");
 }
 
-static int setup_tbf(struct gprs_rlcmac_tbf *tbf, GprsMs *ms, int8_t use_trx, uint8_t ms_class, uint8_t egprs_ms_class,
-		     bool single_slot)
+int gprs_rlcmac_tbf::setup(int8_t use_trx, bool single_slot)
 {
+	struct gprs_rlcmac_bts *bts_data = bts->bts_data();
 	int rc;
-	struct gprs_rlcmac_bts *bts;
-	if (!tbf)
-		return -1;
 
-	bts = tbf->bts->bts_data();
+	if (m_ms->egprs_ms_class() > 0 && bts_data->egprs_enabled) {
+		enable_egprs();
+		setup_egprs_mode(bts_data, m_ms);
+		LOGPTBF(this, LOGL_INFO, "Enabled EGPRS, mode %s\n", mode_name(m_ms->mode()));
+	}
 
-	if (ms->mode() == EGPRS)
-		ms_class = egprs_ms_class;
-
-	tbf->m_created_ts = time(NULL);
-	tbf->set_ms_class(ms_class);
+	m_created_ts = time(NULL);
 	/* select algorithm */
-	rc = bts->alloc_algorithm(bts, ms, tbf, single_slot, use_trx);
+	rc = bts_data->alloc_algorithm(bts_data, m_ms, this, single_slot, use_trx);
 	/* if no resource */
 	if (rc < 0) {
 		return -1;
 	}
 	/* assign control ts */
-	rc = tbf_assign_control_ts(tbf);
+	rc = tbf_assign_control_ts(this);
 	/* if no resource */
 	if (rc < 0) {
 		return -1;
 	}
 
 	/* set timestamp */
-	osmo_clock_gettime(CLOCK_MONOTONIC, &tbf->meas.rssi_tv);
+	osmo_clock_gettime(CLOCK_MONOTONIC, &meas.rssi_tv);
 
-	tbf->set_ms(ms);
-
-	LOGPTBF(tbf, LOGL_INFO,
+	LOGPTBF(this, LOGL_INFO,
 		"Allocated: trx = %d, ul_slots = %02x, dl_slots = %02x\n",
-		tbf->trx->trx_no, tbf->ul_slots(), tbf->dl_slots());
+		this->trx->trx_no, ul_slots(), dl_slots());
 
-	tbf->m_ctrs = rate_ctr_group_alloc(tbf, &tbf_ctrg_desc, next_tbf_ctr_group_id++);
-	if (!tbf->m_ctrs) {
-		LOGPTBF(tbf, LOGL_ERROR, "Couldn't allocate TBF counters\n");
+	m_ctrs = rate_ctr_group_alloc(this, &tbf_ctrg_desc, next_tbf_ctr_group_id++);
+	if (!m_ctrs) {
+		LOGPTBF(this, LOGL_ERROR, "Couldn't allocate TBF counters\n");
 		return -1;
 	}
 
+	m_ms->attach_tbf(this);
+
 	return 0;
 }
 
@@ -968,18 +958,6 @@
 	return 0;
 }
 
-static void setup_egprs_mode(gprs_rlcmac_bts *bts, GprsMs *ms)
-{
-	if (mcs_is_edge_gmsk(mcs_get_egprs_by_num(bts->max_mcs_ul)) &&
-		mcs_is_edge_gmsk(mcs_get_egprs_by_num(bts->max_mcs_dl)) &&
-		ms->mode() != EGPRS)
-	{
-		ms->set_mode(EGPRS_GMSK);
-	} else {
-		ms->set_mode(EGPRS);
-	}
-}
-
 struct gprs_rlcmac_ul_tbf *tbf_alloc_ul_tbf(struct gprs_rlcmac_bts *bts, GprsMs *ms, int8_t use_trx, bool single_slot)
 {
 	struct gprs_rlcmac_ul_tbf *tbf;
@@ -1001,15 +979,9 @@
 	if (!tbf)
 		return NULL;
 	talloc_set_destructor(tbf, ul_tbf_dtor);
-	new (tbf) gprs_rlcmac_ul_tbf(bts->bts);
+	new (tbf) gprs_rlcmac_ul_tbf(bts->bts, ms);
 
-	if (ms->egprs_ms_class() > 0 && bts->egprs_enabled) {
-		tbf->enable_egprs();
-		setup_egprs_mode(bts, ms);
-		LOGPTBF(tbf, LOGL_INFO, "Enabled EGPRS, mode %s\n", mode_name(ms->mode()));
-	}
-
-	rc = setup_tbf(tbf, ms, use_trx, ms->ms_class(), ms->egprs_ms_class(), single_slot);
+	rc = tbf->setup(use_trx, single_slot);
 
 	/* if no resource */
 	if (rc < 0) {
@@ -1068,14 +1040,9 @@
 		return NULL;
 
 	talloc_set_destructor(tbf, dl_tbf_dtor);
-	new (tbf) gprs_rlcmac_dl_tbf(bts->bts);
-	if (ms->egprs_ms_class() > 0 && bts->egprs_enabled) {
-		tbf->enable_egprs();
-		setup_egprs_mode(bts, ms);
-		LOGPTBF(tbf, LOGL_INFO, "Enabled EGPRS, mode %s\n", mode_name(ms->mode()));
-	}
+	new (tbf) gprs_rlcmac_dl_tbf(bts->bts, ms);
 
-	rc = setup_tbf(tbf, ms, use_trx, ms->ms_class(), 0, single_slot);
+	rc = tbf->setup(use_trx, single_slot);
 	/* if no resource */
 	if (rc < 0) {
 		talloc_free(tbf);
@@ -1512,22 +1479,22 @@
 	struct gprs_rlcmac_ul_tbf *ul_tbf = NULL;
 	struct gprs_rlcmac_trx *trx = &bts->trx[trx_no];
 
+	if (!ms)
+		ms = bts->bts->ms_alloc(0, 0);
+	ms->set_tlli(tlli);
+
 	ul_tbf = talloc(tall_pcu_ctx, struct gprs_rlcmac_ul_tbf);
 	if (!ul_tbf)
 		return ul_tbf;
 
 	talloc_set_destructor(ul_tbf, ul_tbf_dtor);
-	new (ul_tbf) gprs_rlcmac_ul_tbf(bts->bts);
-	if (!ms)
-		ms = bts->bts->ms_alloc(0, 0);
-
-	ms->set_tlli(tlli);
+	new (ul_tbf) gprs_rlcmac_ul_tbf(bts->bts, ms);
 
 	llist_add(&ul_tbf->list(), &bts->bts->ul_tbfs());
 	ul_tbf->bts->do_rate_ctr_inc(CTR_TBF_UL_ALLOCATED);
 	TBF_SET_ASS_ON(ul_tbf, GPRS_RLCMAC_FLAG_PACCH, false);
 
-	ul_tbf->set_ms(ms);
+	ms->attach_tbf(ul_tbf);
 	ul_tbf->update_ms(tlli, GPRS_RLCMAC_UL_TBF);
 	TBF_SET_ASS_STATE_UL(ul_tbf, GPRS_RLCMAC_UL_ASS_SEND_ASS_REJ);
 	ul_tbf->control_ts = ts;
diff --git a/src/tbf.h b/src/tbf.h
index ac6c63c..2a3dfbd 100644
--- a/src/tbf.h
+++ b/src/tbf.h
@@ -180,13 +180,14 @@
 #ifdef __cplusplus
 
 struct gprs_rlcmac_tbf {
-	gprs_rlcmac_tbf(BTS *bts_, gprs_rlcmac_tbf_direction dir);
+	gprs_rlcmac_tbf(BTS *bts_, GprsMs *ms, gprs_rlcmac_tbf_direction dir);
 
 	static void free_all(struct gprs_rlcmac_trx *trx);
 	static void free_all(struct gprs_rlcmac_pdch *pdch);
 
 	virtual gprs_rlc_window *window() = 0;
 
+	int setup(int8_t use_trx, bool single_slot);
 	bool state_is(enum gprs_rlcmac_tbf_state rhs) const;
 	bool state_is_not(enum gprs_rlcmac_tbf_state rhs) const;
 	bool dl_ass_state_is(enum gprs_rlcmac_tbf_dl_ass_state rhs) const;
@@ -250,7 +251,6 @@
 	uint8_t ta() const;
 	void set_ta(uint8_t);
 	uint8_t ms_class() const;
-	void set_ms_class(uint8_t);
 	enum CodingScheme current_cs() const;
 	size_t llc_queue_size() const;
 
@@ -263,7 +263,6 @@
 	/* EGPRS */
 	bool is_egprs_enabled() const;
 	void disable_egprs();
-	void enable_egprs();
 
 	/* attempt to make things a bit more fair */
 	void rotate_in_list();
@@ -331,12 +330,8 @@
 	static const char *tbf_state_name[6];
 
 	class GprsMs *m_ms;
-
-	/* Fields to take the TA/MS class values if no MS is associated */
-	uint8_t m_ta;
-	uint8_t m_ms_class;
-
 private:
+	void enable_egprs();
 	enum gprs_rlcmac_tbf_state state;
 	enum gprs_rlcmac_tbf_dl_ass_state dl_ass_state;
 	enum gprs_rlcmac_tbf_ul_ass_state ul_ass_state;
diff --git a/src/tbf_dl.cpp b/src/tbf_dl.cpp
index cbefb1b..0d692cc 100644
--- a/src/tbf_dl.cpp
+++ b/src/tbf_dl.cpp
@@ -60,7 +60,7 @@
 					const uint8_t ms_class)
 {
 	if (!tbf->ms_class() && ms_class)
-		tbf->set_ms_class(ms_class);
+		tbf->ms()->set_ms_class(ms_class);
 }
 
 static void llc_timer_cb(void *_tbf)
@@ -85,8 +85,8 @@
 	timespecclear(&dl_loss_tv);
 }
 
-gprs_rlcmac_dl_tbf::gprs_rlcmac_dl_tbf(BTS *bts_) :
-	gprs_rlcmac_tbf(bts_, GPRS_RLCMAC_DL_TBF),
+gprs_rlcmac_dl_tbf::gprs_rlcmac_dl_tbf(BTS *bts_, GprsMs *ms) :
+	gprs_rlcmac_tbf(bts_, ms, GPRS_RLCMAC_DL_TBF),
 	m_tx_counter(0),
 	m_wait_confirm(0),
 	m_dl_ack_requested(false),
diff --git a/src/tbf_dl.h b/src/tbf_dl.h
index 55306fd..9da942f 100644
--- a/src/tbf_dl.h
+++ b/src/tbf_dl.h
@@ -39,7 +39,7 @@
 #define LOGPTBFDL(tbf, level, fmt, args...) LOGP(DTBFDL, level, "%s " fmt, tbf_name(tbf), ## args)
 
 struct gprs_rlcmac_dl_tbf : public gprs_rlcmac_tbf {
-	gprs_rlcmac_dl_tbf(BTS *bts);
+	gprs_rlcmac_dl_tbf(BTS *bts, GprsMs *ms);
 	gprs_rlc_window *window();
 	void cleanup();
 	/* dispatch Unitdata.DL messages */
diff --git a/src/tbf_ul.cpp b/src/tbf_ul.cpp
index c347885..ed14670 100644
--- a/src/tbf_ul.cpp
+++ b/src/tbf_ul.cpp
@@ -54,8 +54,8 @@
 
 extern void *tall_pcu_ctx;
 
-gprs_rlcmac_ul_tbf::gprs_rlcmac_ul_tbf(BTS *bts_) :
-	gprs_rlcmac_tbf(bts_, GPRS_RLCMAC_UL_TBF),
+gprs_rlcmac_ul_tbf::gprs_rlcmac_ul_tbf(BTS *bts_, GprsMs *ms) :
+	gprs_rlcmac_tbf(bts_, ms, GPRS_RLCMAC_UL_TBF),
 	m_rx_counter(0),
 	m_contention_resolution_done(0),
 	m_final_ack_sent(0),
diff --git a/src/tbf_ul.h b/src/tbf_ul.h
index a581f27..606551c 100644
--- a/src/tbf_ul.h
+++ b/src/tbf_ul.h
@@ -50,7 +50,7 @@
 #define LOGPTBFUL(tbf, level, fmt, args...) LOGP(DTBFUL, level, "%s " fmt, tbf_name(tbf), ## args)
 
 struct gprs_rlcmac_ul_tbf : public gprs_rlcmac_tbf {
-	gprs_rlcmac_ul_tbf(BTS *bts);
+	gprs_rlcmac_ul_tbf(BTS *bts, GprsMs *ms);
 	gprs_rlc_window *window();
 	struct msgb *create_ul_ack(uint32_t fn, uint8_t ts);
 	bool ctrl_ack_to_toggle();