solved some warnings but still lots remain (due also to asn1 problems)

559e81bb · Michele Paffetti · 4e522af6 · 559e81bb · 559e81bb · 559e81bb
Commit 559e81bb authored May 29, 2017 by Michele Paffetti
17 changed files
--- a/openair1/PHY/INIT/defs_nb_iot.h
+++ b/openair1/PHY/INIT/defs_nb_iot.h
@@ -19,8 +19,8 @@
 *      contact@openairinterface.org
 */
-#ifndef __INIT_DEFS__H__
+#ifndef __INIT_DEFS__NB_H__
-#define __INIT_DEFS__H__
+#define __INIT_DEFS__NB_H__
 #include "PHY/defs.h"
@@ -34,6 +34,11 @@
 #if defined(Rel10) || defined(Rel14)
 #include "SCellToAddMod-r10.h"
 #endif
+#include "RadioResourceConfigCommonSIB-NB-r13.h"
+#include "PhysicalConfigDedicated-NB-r13.h"
 /** @addtogroup _PHY_STRUCTURES_
 * @{
 */
@@ -331,29 +336,29 @@ void phy_config_dedicated_scell_eNB(uint8_t Mod_id,
 #endif
 /*brief Configure LTE_DL_FRAME_PARMS with components derived after initial synchronization (MIB-NB decoding + primary/secondary synch).*/
-void NB_phy_config_mib_eNB(int                    Mod_id,
+void NB_phy_config_mib_eNB(int     Mod_id,
 			int                    CC_id,
 			int                    eutra_band,
 			int                    Nid_cell,
 			int                    Ncp,
 			int                    p_eNB,
 			uint32_t               dl_CarrierFreq,
-			uint32_t               ul_CarrierFreq,
+			uint32_t               ul_CarrierFreq);
-			struct MasterInformationBlock_NB__operationModeInfo_r13_u operationModeInfo);
+			//struct MasterInformationBlock_NB__operationModeInfo_r13 operationModeInfo);
 /*NB_phy_config_sib1_eNB is not needed since NB-IoT use only FDD mode*/
 /*brief Configure LTE_DL_FRAME_PARMS with components of SIB2-NB (at eNB).*/
 void NB_phy_config_sib2_eNB(module_id_t                            Mod_id,
-                         int                                CC_id,
+                         int                                	   CC_id,
-                         RadioResourceConfigCommonSIB_NB_r13         *radioResourceConfigCommon,
+                         RadioResourceConfigCommonSIB_NB_r13_t     *radioResourceConfigCommon,
-                         ARFCN_ValueEUTRA_r9_t                     *ul_CArrierFreq,,
+                         ARFCN_ValueEUTRA_r9_t                     *ul_CArrierFreq
                         );
 void NB_phy_config_dedicated_eNB(module_id_t Mod_id,
                              int CC_id,
                              rnti_t rnti,
-                              struct PhysicalConfigDedicated_NB_r13 *physicalConfigDedicated);
+                              PhysicalConfigDedicated_NB_r13_t *physicalConfigDedicated);

--- a/openair1/PHY/INIT/lte_init.c
+++ b/openair1/PHY/INIT/lte_init.c
@@ -37,71 +37,7 @@ extern uint16_t prach_root_sequence_map0_3[838];
 extern uint16_t prach_root_sequence_map4[138];
 uint8_t dmrs1_tab[8] = {0,2,3,4,6,8,9,10};
-#if defined(NB_IoT)
-void NB_phy_config_mib_eNB(int                 Mod_id,
-			int                 CC_id,
-			int                 eutra_band,
-			int                 Nid_cell,
-			int                 Ncp,
-			int                 p_eNB,
-			uint32_t            dl_CarrierFreq,
-			uint32_t            ul_CarrierFreq) {
-  LTE_DL_FRAME_PARMS *fp;
-  LOG_I(PHY,"Configuring MIB for instance %d, CCid %d : (band %d,N_RB_DL %d,Nid_cell %d,p %d,DL freq %u)\n",
-	Mod_id, CC_id, eutra_band, N_RB_DL_array[dl_Bandwidth], Nid_cell, p_eNB,dl_CarrierFreq);
-  /*if (RC.eNB == NULL) {
-    RC.eNB                               = (PHY_VARS_eNB ***)malloc((1+NUMBER_OF_eNB_MAX)*sizeof(PHY_VARS_eNB***));
-    LOG_I(PHY,"RC.eNB = %p\n",RC.eNB);
-    memset(RC.eNB,0,(1+NUMBER_OF_eNB_MAX)*sizeof(PHY_VARS_eNB***));
-  }
-  if (RC.eNB[Mod_id] == NULL) {
-    RC.eNB[Mod_id]                       = (PHY_VARS_eNB **)malloc((1+MAX_NUM_CCs)*sizeof(PHY_VARS_eNB**));
-    LOG_I(PHY,"RC.eNB[%d] = %p\n",Mod_id,RC.eNB[Mod_id]);
-    memset(RC.eNB[Mod_id],0,(1+MAX_NUM_CCs)*sizeof(PHY_VARS_eNB***));
-  }
-  if (RC.eNB[Mod_id][CC_id] == NULL) {
-    RC.eNB[Mod_id][CC_id] = (PHY_VARS_eNB *)malloc(sizeof(PHY_VARS_eNB));
-    LOG_I(PHY,"RC.eNB[%d][%d] = %p\n",Mod_id,CC_id,RC.eNB[Mod_id][CC_id]);
-    RC.eNB[Mod_id][CC_id]->Mod_id        = Mod_id;
-    RC.eNB[Mod_id][CC_id]->CC_id         = CC_id;
-  }
-  RC.eNB[Mod_id][CC_id]->mac_enabled     = 1;
-  fp = &RC.eNB[Mod_id][CC_id]->frame_parms; */
-  fp->Nid_cell                           = Nid_cell;
-  fp->nushift                            = Nid_cell%6;
-  fp->eutra_band                         = eutra_band;
-  fp->Ncp                                = Ncp;
-  fp->nb_antenna_ports_eNB               = p_eNB;
-  fp->dl_CarrierFreq                     = dl_CarrierFreq;
-  fp->ul_CarrierFreq                     = ul_CarrierFreq;
-  init_frame_parms(fp,1);
-  init_lte_top(fp);
-}
-void NB_phy_config_sib2_eNB(uint8_t Mod_id,
-                         int CC_id,
-                         RadioResourceConfigCommonSIB_t *radioResourceConfigCommon,
-                         ARFCN_ValueEUTRA_t *ul_CArrierFreq,
-                         AdditionalSpectrumEmission_t *additionalSpectrumEmission,
-                         )
-{
-}
-#endif
-// FIXME not used anywhere
 void phy_config_mib(LTE_DL_FRAME_PARMS *fp,
                    uint8_t N_RB_DL,
                    uint8_t Nid_cell,

--- a/openair1/PHY/INIT/lte_init_nb_iot.c
+++ b/openair1/PHY/INIT/lte_init_nb_iot.c
@@ -36,12 +36,11 @@
 //NB-IoT
 #include "defs_nb_iot.h"
 #include "RadioResourceConfigCommonSIB-NB-r13.h"
-#include "PHY/impl_defs_lte_nb_iot.h"
 #include "RadioResourceConfigDedicated-NB-r13.h"
 extern uint16_t prach_root_sequence_map0_3[838];
 extern uint16_t prach_root_sequence_map4[138];
-uint8_t dmrs1_tab[8] = {0,2,3,4,6,8,9,10};
+//uint8_t dmrs1_tab[8] = {0,2,3,4,6,8,9,10};
 void NB_phy_config_mib_eNB(int                 Mod_id,
@@ -76,7 +75,7 @@ void NB_phy_config_mib_eNB(int                 Mod_id,
  fp = &RC.eNB[Mod_id][CC_id]->frame_parms; */
-  NB_DL_FRAME_PARMS *fp = &PHY_vars_eNB_g[Mod_id][CC_id]->frame_parms;
+  NB_DL_FRAME_PARMS *fp = &PHY_vars_eNB_g[Mod_id][CC_id]->frame_parms; //MP: PHY_VARS_eNB still to be modified
   //LOG_I(PHY,"Configuring MIB-NB for instance %d, CCid %d : (band %d,N_RB_DL %d,Nid_cell %d,p %d,DL freq %u)\n",
 	//Mod_id, CC_id, eutra_band, N_RB_DL_array[dl_Bandwidth], Nid_cell, p_eNB,dl_CarrierFreq);

--- a/openair1/PHY/defs.h
+++ b/openair1/PHY/defs.h
@@ -119,6 +119,7 @@ static inline void* malloc16_clear( size_t size )
 #include "impl_defs_top.h"
 #include "impl_defs_lte.h"
+#include "impl_defs_lte_nb_iot.h"
 #include "PHY/TOOLS/time_meas.h"
 #include "PHY/CODING/defs.h"

--- a/openair2/LAYER2/MAC/eNB_scheduler_primitives.c
+++ b/openair2/LAYER2/MAC/eNB_scheduler_primitives.c
@@ -261,6 +261,9 @@ void dump_ue_list(UE_list_t *listP, int ul_flag)
  }
 }
+//---------------------
 int add_new_ue(module_id_t mod_idP, int cc_idP, rnti_t rntiP,int harq_pidP)
 {
  int UE_id;

--- a/openair2/LAYER2/PDCP_v10.1.0/pdcp.c
+++ b/openair2/LAYER2/PDCP_v10.1.0/pdcp.c
@@ -1669,7 +1669,7 @@ pdcp_config_set_security(
 	  pdcp_pP->integrityProtAlgorithm,
 	  ctxt_pP->rnti);
  }
-  /*particular case activated by SecurityModeFailure*/
+  /*]SecurityModeFailure*/
  else if(security_modeP == -1){
 	  // in this way in NB_pdcp_data_req function you never call "pdcp_apply_security"
 	  // and we never call pdcp_validate_security in NB_pdcp_data_indi

--- a/openair2/LAYER2/RLC/AM_v9.3.0/rlc_am_entity.h
+++ b/openair2/LAYER2/RLC/AM_v9.3.0/rlc_am_entity.h
@@ -134,7 +134,7 @@ typedef struct rlc_am_entity_s {
  uint16_t           max_retx_threshold; /*!< \brief This parameter is used by the transmitting side of each AM RLC entity to limit the number of retransmissions of an AMD PDU. */
  uint16_t           poll_pdu;           /*!< \brief This parameter is used by the transmitting side of each AM RLC entity to trigger a poll for every pollPDU PDUs. */
  uint32_t           poll_byte;          /*!< \brief This parameter is used by the transmitting side of each AM RLC entity to trigger a poll for every pollByte bytes. */
-  uint16_t	     enableStatusReportSN_Gap;
+  uint32_t	     enableStatusReportSN_Gap;
  //---------------------------------------------------------------------
  // STATISTICS

--- a/openair2/RRC/LITE/L2_interface_nb_iot.c
+++ b/openair2/RRC/LITE/L2_interface_nb_iot.c
@@ -27,10 +27,12 @@
 * \email: raymond.knopp@eurecom.fr
 */
 #include "PHY/defs.h"
+#include "PHY/INIT/defs_nb_iot.h"
 #include "SCHED/defs.h"
 #include "platform_types.h"
 #include "defs_nb_iot.h" //RRC
 #include "LAYER2/MAC/defs_nb_iot.h" //MAC
+#include "LAYER2/MAC/defs.h" // MAC because see the PHY functions
 #include "extern.h"
 #include "LAYER2/MAC/extern.h"
 #include "UTIL/LOG/log.h"
@@ -38,10 +40,14 @@
 #include "rrc_eNB_UE_context.h"
 #include "pdcp_primitives.h"
 #include "pdcp.h"
+#include "pdcp_util.h"
+#include "rlc.h"
 #include "msc.h"
 #include "UTIL/LOG/vcd_signal_dumper.h"
 #include "gtpv1u.h"
 #include "osa_defs.h"
+#include "pdcp_sequence_manager.h"
+#include "UTIL/OTG/otg_rx.h"
 #ifdef PHY_EMUL
 #include "SIMULATION/simulation_defs.h"
@@ -66,7 +72,7 @@ typedef boolean_t mib_flag_t;
 #define MIB_FLAG_YES	TRUE
 #define MIB_FLAG_NO		FALSE
-mui_t mui=0;
+//mui_t mui_NB=0;
 //XXX MP: just temporary usage since i put in one single file all the primitives modified (but they should be relocated in the
 //proper file where they are defined as indicated in the comments
@@ -95,6 +101,10 @@ extern struct mac_data_ind mac_rlc_deserialize_tb (
 		  const tb_size_t tb_sizeP,
 		  num_tb_t  num_tbP,
 		  crc_t    *crcs_pP);
+extern void rlc_am_init_timer_poll_retransmit(
+	    const protocol_ctxt_t* const ctxt_pP,
+	    rlc_am_entity_t* const       rlc_pP,
+	    const uint32_t               time_outP);
 /*---------------------------------RRC-MAC-----------------------------------*/
@@ -139,9 +149,9 @@ int NB_rrc_mac_config_req_eNB(
  if (mib_NB!=NULL) {
-    if (eNB_mac_inst == NULL) l2_init_eNB(); //XXX MP: to be included in the MAC/main.c
+    //if (eNB_mac_inst == NULL) l2_init_eNB(); //XXX MP: to be included in the MAC/main.c
-    mac_top_init_eNB(); //XXX MP:  to be included in the MAC/main.c
+   // mac_top_init_eNB(); //XXX MP:  to be included in the MAC/main.c
    eNB_mac_inst_NB[Mod_idP].common_channels[CC_idP].mib_NB           = mib_NB;
    eNB_mac_inst_NB[Mod_idP].common_channels[CC_idP].physCellId     = physCellId;
@@ -150,16 +160,17 @@ int NB_rrc_mac_config_req_eNB(
    eNB_mac_inst_NB[Mod_idP].common_channels[CC_idP].eutra_band     = eutra_band;
    eNB_mac_inst_NB[Mod_idP].common_channels[CC_idP].dl_CarrierFreq = dl_CarrierFreq;
-//  NB_phy_config_mib_eNB(Mod_idP,CC_idP, //XXX MP: defined by Nick in lte_init_nb_iot.c
+  NB_phy_config_mib_eNB(Mod_idP,
-//				  eutra_band,
+		  	  	  	  	CC_idP,
-//				  physCellId,
+						eutra_band,
-//				  Ncp,
+						physCellId,
-//				  p_eNB,
+						Ncp,
-//				  dl_CarrierFreq,
+						p_eNB,
-//				  ul_CarrierFreq,
+						dl_CarrierFreq,
-//				  mib_NB->message.operationModeInfo_r13);
+						ul_CarrierFreq);
+				  //mib_NB->message.operationModeInfo_r13);
-    mac_init_cell_params(Mod_idP,CC_idP);
+   // mac_init_cell_params(Mod_idP,CC_idP); //XXX to be defined in MAC/main.c
  }
  //phy_config_sib1_eNB--> not implemented for NB_IoT
@@ -167,10 +178,10 @@ int NB_rrc_mac_config_req_eNB(
  if (radioResourceConfigCommon!=NULL) {
      LOG_I(MAC,"[CONFIG]SIB2/3-NB Contents (partial)\n");
-      LOG_I(MAC,"[CONFIG]npusch_ConfigCommon_r13.dmrs_Config_r13->threeTone_CyclicShift_r13= %d\n", radioResourceConfigCommon->npusch_ConfigCommon_r13.dmrs_Config_r13->threeTone_CyclicShift_r13);
+      LOG_I(MAC,"[CONFIG]npusch_ConfigCommon_r13.dmrs_Config_r13->threeTone_CyclicShift_r13= %ld\n", radioResourceConfigCommon->npusch_ConfigCommon_r13.dmrs_Config_r13->threeTone_CyclicShift_r13);
-      LOG_I(MAC,"[CONFIG]npusch_ConfigCommon_r13.dmrs_Config_r13->sixTone_CyclicShift_r13= %d\n", radioResourceConfigCommon->npusch_ConfigCommon_r13.dmrs_Config_r13->sixTone_CyclicShift_r13);
+      LOG_I(MAC,"[CONFIG]npusch_ConfigCommon_r13.dmrs_Config_r13->sixTone_CyclicShift_r13= %ld\n", radioResourceConfigCommon->npusch_ConfigCommon_r13.dmrs_Config_r13->sixTone_CyclicShift_r13);
      LOG_I(MAC,"[CONFIG]npusch_ConfigCommon_r13.ul_ReferenceSignalsNPUSCH_r13.groupHoppingEnabled_r13= %d\n", radioResourceConfigCommon->npusch_ConfigCommon_r13.ul_ReferenceSignalsNPUSCH_r13.groupHoppingEnabled_r13);
-      LOG_I(MAC,"[CONFIG]npusch_ConfigCommon_r13.ul_ReferenceSignalsNPUSCH_r13.groupAssignmentNPUSCH_r13= %d\n", radioResourceConfigCommon->npusch_ConfigCommon_r13.ul_ReferenceSignalsNPUSCH_r13.groupAssignmentNPUSCH_r13);
+      LOG_I(MAC,"[CONFIG]npusch_ConfigCommon_r13.ul_ReferenceSignalsNPUSCH_r13.groupAssignmentNPUSCH_r13= %ld\n", radioResourceConfigCommon->npusch_ConfigCommon_r13.ul_ReferenceSignalsNPUSCH_r13.groupAssignmentNPUSCH_r13);
      eNB_mac_inst_NB[Mod_idP].common_channels[CC_idP].radioResourceConfigCommon = radioResourceConfigCommon;
@@ -179,12 +190,12 @@ int NB_rrc_mac_config_req_eNB(
      //no ul_Bandwidth
-//     NB_phy_config_sib2_eNB( //XXX MP: defined by Nick in lte_init_nb_iot.c
+     NB_phy_config_sib2_eNB(
-//    		  Mod_idP,
+    		  Mod_idP,
-//    		  CC_idP,
+    		  CC_idP,
-//			  radioResourceConfigCommon,
+			  radioResourceConfigCommon,
-//			  NULL //ul_carrier_frequency
+			  NULL //ul_carrier_frequency
-//			  );
+			  );
  }
@@ -207,11 +218,11 @@ int NB_rrc_mac_config_req_eNB(
      LOG_E(MAC,"%s:%d:%s: ERROR, UE_id == -1\n", __FILE__, __LINE__, __FUNCTION__);
    else
    {
-//   NB_phy_config_dedicated_eNB( //XXX MP: defined by Nick in lte_init_nb_iot.c
+   NB_phy_config_dedicated_eNB(
-//    		  Mod_idP,
+    		  Mod_idP,
-//			  CC_idP,
+			  CC_idP,
-//			  UE_RNTI(Mod_idP, UE_id),
+			  UE_RNTI(Mod_idP, UE_id),
-//			  physicalConfigDedicated);
+			  physicalConfigDedicated);
    }
  }
@@ -249,7 +260,7 @@ boolean_t is_SIB1_NB(
 	         * within the 2560 ms period
 	         *
 	         *
-	         * 0)find the SIB1-NB period over the 1024 frames in which the actual frame fall (FIXME check if every 1023 wrap around the frame in OAI)
+	         * 0)find the SIB1-NB period over the 1024 frames in which the actual frame fall
 	         * 1)from the schedulingInfoSIB1 of MIB-NB and the physCell_id we deduce the starting radio frame
 	         * 2)check if the actual frame is after the staring radio frame
 	         * 3)check if the actual frame is within a SIB1-transmission interval
@@ -364,7 +375,7 @@ boolean_t is_SIB23_NB(
 	/*
-	 * SIB23-NB (xxx should be decided if include the SIB3 or not)
+	 * SIB23-NB
 	 *
 	 * The entire scheduling of the SI-Message is given by SIB1-NB information
 	 *
@@ -410,7 +421,7 @@ boolean_t is_SIB23_NB(
 	si_periodicity = si_period_to_nb[si_period];
 	//check if the actual frame is within an HSFN interval that will include si-window (relation with the si-periodicity)
-	//XXX this could happen when the si-periodicity is larger than a HSFN interval (1024 rf)
+	//this could happen when the si-periodicity is larger than a HSFN interval (1024 rf)
 	hsfn_in_periodicity = (int) si_periodicity/1024;
 	if(hsfn_in_periodicity > 1){//periodicity is larger than 1024rf (HSFN) and  not in all the hsfn a transmission will occurr
@@ -488,6 +499,7 @@ int8_t NB_mac_rrc_data_req_eNB(
  const int         CC_id,
  const frame_t     frameP,
  const frame_t		h_frameP,
+  const sub_frame_t   subframeP, //need for the case in which both SIB1-NB and SIB23-NB will be scheduled in the same frame
  const rb_id_t     Srb_id,
  uint8_t*    const buffer_pP,
  long				schedulingInfoSIB1,//from the mib
@@ -562,7 +574,8 @@ int8_t NB_mac_rrc_data_req_eNB(
            }
-         if(is_SIB1_NB(frameP,schedulingInfoSIB1, physCellId)){
+            //sib1-NB scheduled in subframe #4
+         if(subframeP == 4 && is_SIB1_NB(frameP,schedulingInfoSIB1, physCellId)){
 			  memcpy(&buffer_pP[0],
 					  eNB_rrc_inst_NB[Mod_idP].carrier[CC_id].SIB1_NB,
@@ -614,7 +627,8 @@ int8_t NB_mac_rrc_data_req_eNB(
        return(0);
    }
-    if( (Srb_id & RAB_OFFSET ) == CCCH) { //called when is requested the Msg3 transmission
+    //called when is requested the Msg4 transmission (RRCConnectionSetup)
+    if( (Srb_id & RAB_OFFSET ) == CCCH) {
      LOG_T(RRC,"[eNB %d] Frame %d CCCH request (Srb_id %d)\n",Mod_idP,frameP, Srb_id);
      if(eNB_rrc_inst_NB[Mod_idP].carrier[CC_id].Srb0.Active==0) {
@@ -628,7 +642,11 @@ int8_t NB_mac_rrc_data_req_eNB(
      if(Srb_info->Tx_buffer.payload_size>0) { //Fill buffer
        LOG_D(RRC,"[eNB %d] CCCH (%p) has %d bytes (dest: %p, src %p)\n",Mod_idP,Srb_info,Srb_info->Tx_buffer.payload_size,buffer_pP,Srb_info->Tx_buffer.Payload);
-        memcpy(buffer_pP,Srb_info->Tx_buffer.Payload,Srb_info->Tx_buffer.payload_size);
+        //RRC_MAC_CCCH_DATA_REQ not implemented in MAC/eNB_scheduler.c
+        memcpy(buffer_pP, //CCCH_pdu.payload[0]
+        	   Srb_info->Tx_buffer.Payload,Srb_info->Tx_buffer.payload_size);
        Sdu_size = Srb_info->Tx_buffer.payload_size;
        Srb_info->Tx_buffer.payload_size=0;
      }
@@ -727,6 +745,25 @@ void NB_mac_eNB_rrc_ul_failure(
 }
+//defined in eNB_scheduler_primitives.c
+void dump_ue_list_NB(UE_list_NB_t *listP, int ul_flag)
+{
+  int j;
+  if ( ul_flag == 0 ) {
+    for (j=listP->head; j>=0; j=listP->next[j]) {
+      LOG_T(MAC,"node %d => %d\n",j,listP->next[j]);
+    }
+  } else {
+    for (j=listP->head_ul; j>=0; j=listP->next_ul[j]) {
+      LOG_T(MAC,"node %d => %d\n",j,listP->next_ul[j]);
+    }
+  }
+}
 //defined in eNB_scheduler_primitives.c
 int NB_rrc_mac_remove_ue(
 		module_id_t mod_idP,
@@ -748,7 +785,7 @@ printf("MAC: cannot remove UE rnti %x\n", rntiP);
 printf("MAC: remove UE %d rnti %x\n", UE_id, rntiP);
  LOG_I(MAC,"Removing UE %d from Primary CC_id %d (rnti %x)\n",UE_id,pCC_id, rntiP);
-  dump_ue_list(UE_list,0); //may should be changed
+  dump_ue_list_NB(UE_list,0);
  UE_list->active[UE_id] = FALSE;
  UE_list->num_UEs--;
@@ -766,7 +803,7 @@ printf("MAC: remove UE %d rnti %x\n", UE_id, rntiP);
  eNB_dlsch_info[mod_idP][pCC_id][UE_id].rnti                        = NOT_A_RNTI;
  eNB_dlsch_info[mod_idP][pCC_id][UE_id].status                      = S_DL_NONE;
-  NB_mac_phy_remove_ue(mod_idP,rntiP);
+  mac_phy_remove_ue(mod_idP,rntiP); //PHY/defs.h
  // check if this has an RA process active
  RA_TEMPLATE_NB *RA_template;
@@ -788,6 +825,8 @@ printf("MAC: remove UE %d rnti %x\n", UE_id, rntiP);
  return 0;
 }
 //defined in L2_interface
 void NB_mac_eNB_rrc_ul_in_sync(
 				const module_id_t mod_idP,
@@ -831,6 +870,35 @@ int NB_mac_eNB_get_rrc_status(
 /*----------------------------------RRC-PDCP--------------------------------------*/
+//defined in pdcp_security.c
+static
+uint32_t pdcp_get_next_count_tx_NB(pdcp_t *const pdcp_pP, const srb_flag_t srb_flagP, const uint16_t pdcp_sn);
+//-----------------------------------------------------------------------------
+static
+uint32_t pdcp_get_next_count_tx_NB(
+  pdcp_t * const pdcp_pP,
+  const srb_flag_t srb_flagP,
+  const uint16_t pdcp_sn
+)
+{
+  uint32_t count; //32 bits
+  /* For TX COUNT = TX_HFN << length of SN | pdcp SN */
+  if (srb_flagP) {
+    /* 5 bits length SN */
+    count = ((pdcp_pP->tx_hfn << 5)  | (pdcp_sn & 0x001F));
+  } else { //DRB
+    /*Default is the 7 bits length SN TS 36.323 ch 6.2.4*/
+    count = ((pdcp_pP->tx_hfn << 7) | (pdcp_sn & 0x007F)); //FIXME: MP: to be check if ok
+  }
+  LOG_D(PDCP, "[OSA] TX COUNT = 0x%08x\n", count);
+  return count;
+}
 //defined in pdcp_security.c
 //called in NB_pdcp_data_req
@@ -858,7 +926,7 @@ NB_pdcp_apply_security(
  encrypt_params.direction  = (pdcp_pP->is_ue == 1) ? SECU_DIRECTION_UPLINK : SECU_DIRECTION_DOWNLINK;
  encrypt_params.bearer     = rb_id - 1;
-  encrypt_params.count      = pdcp_get_next_count_tx(pdcp_pP, srb_flagP, current_sn);
+  encrypt_params.count      = pdcp_get_next_count_tx_NB(pdcp_pP, srb_flagP, current_sn); //XXX (warning) because static defined in pdcp_security.c
  encrypt_params.key_length = 16;
  if (srb_flagP) {
@@ -904,8 +972,6 @@ NB_pdcp_apply_security(
 }
 //FIXME for the moment we not configure PDCP for SRB1bis (but used as it is SRB1)
 //defined in pdcp.c
 boolean_t NB_rrc_pdcp_config_asn1_req (
@@ -954,7 +1020,7 @@ boolean_t NB_rrc_pdcp_config_asn1_req (
 	  if(LCID == DCCH0) //SRB1bis
 	  	{
-		  LOG_E(PDCP, PROTOCOL_PDCP_CTXT_FMT" PDCP Configiration for SRB1bis not allowed\n");
+		  LOG_E(PDCP,"PDCP Configuration for SRB1bis not allowed\n");
 		  return 0;
 		}
 	  else
@@ -969,7 +1035,7 @@ boolean_t NB_rrc_pdcp_config_asn1_req (
    	LOG_D(PDCP, "SecurityModeFailure --> NB_rrc_pdcp_config_asn1_req --> Disabling security for srb2add_list_pP\n");
-    	for(int cnt=0; cnt< srb2add_list_pP->list.count; cnt++)//may not needed a loop
+    	for(int cnt=0; cnt< srb2add_list_pP->list.count; cnt++)
    	   {
    	    key = PDCP_COLL_KEY_VALUE(ctxt_pP->module_id, ctxt_pP->rnti, ENB_FLAG_YES, srb_id, SRB_FLAG_YES);
@@ -1755,7 +1821,7 @@ boolean_t NB_pdcp_data_req(
          start_meas(&UE_pdcp_stats[ctxt_pP->module_id].apply_security);
        }
-        //FIXME also this function should be checked for NB-IoT (defined in pdcp_security.c)
        NB_pdcp_apply_security(ctxt_pP,
                            pdcp_p,
                            srb_flagP,
@@ -1862,7 +1928,6 @@ boolean_t NB_pdcp_data_req(
 //defined in L2_interface
 void NB_rrc_data_ind(
  const protocol_ctxt_t* const ctxt_pP,
@@ -1893,7 +1958,7 @@ void NB_rrc_data_ind(
          ctxt_pP->rnti);
  }
-  //FiXME: MP: we should put out this messages from ITTI
+  //FiXME: MP: we should put out this messages from ITTI ??
 #if defined(ENABLE_ITTI) //From PDCP to RRC
  {
    MessageDef *message_p;
@@ -1919,7 +1984,7 @@ void NB_rrc_data_ind(
  if (ctxt_pP->enb_flag == ENB_FLAG_YES) {
    rrc_eNB_decode_dcch_NB(
      ctxt_pP,
-	  DCCH_index, //--> becomes the srb_id in decode_dcch
+	  DCCH_index, // becomes the srb_id in decode_dcch
      buffer_pP,
      sdu_sizeP);
  } else {
@@ -1934,10 +1999,6 @@ void NB_rrc_data_ind(
 #endif
 }
-//defined in pdcp.c
-boolean_t NB_pdcp_remove_UE(
-  const protocol_ctxt_t* const  ctxt_pP
-);
 /*---------------------------------RRC-RLC-----------------------------------*/
@@ -2163,14 +2224,14 @@ void NB_config_req_rlc_am_asn1 (
            maxRetxThreshold_NB_tab[config_am_pP->ul_AM_RLC_r13.maxRetxThreshold_r13],
            pollRetransmit_NB_tab[config_am_pP->ul_AM_RLC_r13.t_PollRetransmit_r13]);
-      //FIXME: the following function are ok for NB_IoT??
+      //XXX: the following function are ok for NB_IoT??
      rlc_am_init(ctxt_pP, l_rlc_p);
      rlc_am_set_debug_infos(ctxt_pP, l_rlc_p, srb_flagP, rb_idP, chan_idP);
      NB_rlc_am_configure(ctxt_pP,
-    		  	  	  	  l_rlc_p,
+    		  	  	  	l_rlc_p,
-						  maxRetxThreshold_NB_tab[config_am_pP->ul_AM_RLC_r13.maxRetxThreshold_r13],
+						maxRetxThreshold_NB_tab[config_am_pP->ul_AM_RLC_r13.maxRetxThreshold_r13],
-						  pollRetransmit_NB_tab[config_am_pP->ul_AM_RLC_r13.t_PollRetransmit_r13],
+						pollRetransmit_NB_tab[config_am_pP->ul_AM_RLC_r13.t_PollRetransmit_r13],
-						  config_am_pP->dl_AM_RLC_r13.enableStatusReportSN_Gap_r13); //may not needed to be passed
+						(uint32_t* const) config_am_pP->dl_AM_RLC_r13.enableStatusReportSN_Gap_r13); //MP:XXX very bad cast
    } else {
      MSC_LOG_RX_DISCARDED_MESSAGE(
        (ctxt_pP->enb_flag == ENB_FLAG_YES) ? MSC_RLC_ENB:MSC_RLC_UE,
@@ -2201,7 +2262,7 @@ NB_rlc_am_configure(
  rlc_am_entity_t *const        rlc_pP,
  const uint16_t                max_retx_thresholdP,
  const uint16_t                t_poll_retransmitP,
-  const uint16_t* const			enableStatusReportSN_Gap
+  const uint32_t* const			enableStatusReportSN_Gap
  )
 {
  if (rlc_pP->configured == TRUE) {
@@ -2216,7 +2277,7 @@ NB_rlc_am_configure(
    rlc_pP->max_retx_threshold = max_retx_thresholdP;
    rlc_pP->protocol_state     = RLC_DATA_TRANSFER_READY_STATE;
    rlc_pP->t_poll_retransmit.ms_duration   = t_poll_retransmitP;
-    rlc_pP->enableStatusReportSN_Gap = *(enableStatusReportSN_Gap); //FIXME: new defined in rlc_am_entity
+    rlc_pP->enableStatusReportSN_Gap = *enableStatusReportSN_Gap; //XXX: warning
  } else {
@@ -2229,7 +2290,7 @@ NB_rlc_am_configure(
    rlc_pP->max_retx_threshold = max_retx_thresholdP;
    rlc_pP->protocol_state     = RLC_DATA_TRANSFER_READY_STATE;
-    rlc_pP->enableStatusReportSN_Gap = enableStatusReportSN_Gap;
+    rlc_pP->enableStatusReportSN_Gap = *enableStatusReportSN_Gap;
    rlc_am_init_timer_poll_retransmit(ctxt_pP, rlc_pP, t_poll_retransmitP);
@@ -2410,7 +2471,8 @@ rlc_op_status_t NB_rrc_rlc_remove_rlc   (
  return RLC_OP_STATUS_OK;
 }
-//defined in rlc_rrc.c //used only for process_RRCConnectionReconfigurationComplete --> CONFIG_ACTION_REMOVE
+//defined in rlc_rrc.c
+//used for process_RRCConnectionReconfigurationComplete --> CONFIG_ACTION_REMOVE
 //used also for rrc_t310_expiration --> I don't know if it is used (probably not)
 rlc_op_status_t NB_rrc_rlc_config_req   (
  const protocol_ctxt_t* const ctxt_pP,
@@ -2452,7 +2514,7 @@ rlc_op_status_t NB_rrc_rlc_config_req   (
      NB_config_req_rlc_am(
        ctxt_pP,
        srb_flagP,
-        &rlc_infoP.rlc.rlc_am_info_NB, //MP: pass the volatile structure for NB_IoT protocol params in rlc_am_init.h
+        &rlc_infoP.rlc.rlc_am_info_NB, //MP: pass the volatile structure for NB_IoT protocol params in rlc_am_init.h // warning present
        rb_idP, rb_idP);
      break;
@@ -2599,7 +2661,7 @@ rlc_op_status_t NB_rrc_rlc_remove_ue (
 }
 //defined in rlc_rrc.c --> NO MORE USED PROBABLY
-//void NB_rrc_rlc_register_rrc ( //what do?
+//void NB_rrc_rlc_register_rrc (
 //		rrc_data_ind_cb_t rrc_data_indP,
 //		rrc_data_conf_cb_t rrc_data_confP
 //		);
@@ -2663,7 +2725,7 @@ rlc_op_status_t NB_rlc_data_req     (const protocol_ctxt_t* const ctxt_pP,
 #if defined(Rel10) || defined(Rel14)
-  logical_chan_id_t      log_ch_id  = 0;
+ //logical_chan_id_t      log_ch_id  = 0;
 #endif
 #ifdef DEBUG_RLC_DATA_REQ
  LOG_D(RLC,PROTOCOL_CTXT_FMT"rlc_data_req:  rb_id %u (MAX %d), muip %d, confirmP %d, sdu_sizeP %d, sdu_pP %p\n",
@@ -2863,7 +2925,7 @@ rlc_op_status_t NB_rlc_data_req     (const protocol_ctxt_t* const ctxt_pP,
 //defined in pdcp.c
-//FIXME: should go transparent through the PDCP
+//if SRB1bis go transparently through PDCP
 //--------------------------------------------
 boolean_t
 NB_pdcp_data_ind(
@@ -3363,22 +3425,25 @@ void NB_mac_rlc_data_ind     (
  rlc_union_t           *rlc_union_p     = NULL;
  hash_key_t             key             = HASHTABLE_NOT_A_KEY_VALUE;
  hashtable_rc_t         h_rc;
-  //XXX MP: modify the check on LCID
  srb_flag_t             srb_flag        = (channel_idP <= 3) ? SRB_FLAG_YES : SRB_FLAG_NO;
-  srb1bis_flag_t         srb1bis_flag    = (channel_idP == 3) ? SRB1BIS_FLAG_YES : SRB1BIS_FLAG_NO; //may not needed?
+  //srb1bis_flag_t         srb1bis_flag    = (channel_idP == 3) ? SRB1BIS_FLAG_YES : SRB1BIS_FLAG_NO; //may not needed?
  protocol_ctxt_t     ctxt;
  PROTOCOL_CTXT_SET_BY_MODULE_ID(&ctxt, module_idP, enb_flagP, rntiP, frameP, 0, eNB_index);
  VCD_SIGNAL_DUMPER_DUMP_FUNCTION_BY_NAME(VCD_SIGNAL_DUMPER_FUNCTIONS_MAC_RLC_DATA_IND,VCD_FUNCTION_IN);
+  if(channel_idP == 2)
+	  LOG_E(RLC, "NB_mac_rlc_data_ind over srb_id invalid (%d)\n", channel_idP);
 #ifdef DEBUG_MAC_INTERFACE
  if (num_tbP) {
    LOG_D(RLC, PROTOCOL_CTXT_FMT" MAC_RLC_DATA_IND on channel %d (%d), rb max %d, Num_tb %d\n",
          PROTOCOL_CTXT_ARGS(&ctxt),
          channel_idP,
-          RLC_MAX_LC, //XXX ???
+          RLC_MAX_LC,
 		  NB_RB_MAX_NB_IOT,
          num_tbP);
  }
@@ -3407,7 +3472,7 @@ void NB_mac_rlc_data_ind     (
  h_rc = hashtable_get(rlc_coll_p, key, (void**)&rlc_union_p);
-  //XXX MP: also for SRB1bis an RLC-AM mode should be configured
+  //MP: also for SRB1bis an RLC-AM mode should be configured
  if (h_rc == HASH_TABLE_OK) {
    rlc_mode = rlc_union_p->mode;
  } else {
@@ -3433,7 +3498,7 @@ void NB_mac_rlc_data_ind     (
    break;
  default:
-	  LOG_E(RLC,PROTOCOL_PDCP_CTXT_FMT"mac_rlc_data_ind -> RLC mode unknown");
+	  LOG_E(RLC,"mac_rlc_data_ind -> RLC mode unknown");
 	break;
  }
@@ -3687,13 +3752,18 @@ tbs_size_t NB_mac_rlc_data_req_eNB(
  hash_key_t             key             = HASHTABLE_NOT_A_KEY_VALUE;
  hashtable_rc_t         h_rc;
  srb_flag_t             srb_flag        = (channel_idP <= 3) ? SRB_FLAG_YES : SRB_FLAG_NO;
-  srb1bis_flag_t			srb1bis_flag = (channel_idP == 3) ? SRB1BIS_FLAG_YES : SRB1BIS_FLAG_NO;
+  //srb1bis_flag_t			srb1bis_flag = (channel_idP == 3) ? SRB1BIS_FLAG_YES : SRB1BIS_FLAG_NO;
  tbs_size_t             ret_tb_size         = 0;
  protocol_ctxt_t     ctxt;
  PROTOCOL_CTXT_SET_BY_MODULE_ID(&ctxt, module_idP, ENB_FLAG_YES, rntiP, frameP, 0,eNB_index);
  VCD_SIGNAL_DUMPER_DUMP_FUNCTION_BY_NAME(VCD_SIGNAL_DUMPER_FUNCTIONS_MAC_RLC_DATA_REQ,VCD_FUNCTION_IN);
+  if(channel_idP == 2)
+  	  LOG_E(RLC, "NB_mac_rlc_data_req_eNB over srb_id invalid (%d)\n", channel_idP);
 #ifdef DEBUG_MAC_INTERFACE
  LOG_D(RLC, PROTOCOL_CTXT_FMT" MAC_RLC_DATA_REQ channel %d (%d) MAX RB %d, Num_tb %d\n",
        PROTOCOL_CTXT_ARGS((&ctxt)),

--- a/openair2/RRC/LITE/MESSAGES/asn1_msg_nb_iot.c
+++ b/openair2/RRC/LITE/MESSAGES/asn1_msg_nb_iot.c
@@ -48,29 +48,7 @@
 #include <per_encoder.h>
 #include "assertions.h"
-//#include "RRCConnectionRequest.h"
-//#include "UL-CCCH-Message.h"
-//#include "UL-DCCH-Message.h"
-//#include "DL-CCCH-Message.h"
-//#include "DL-DCCH-Message.h"
-//#include "EstablishmentCause.h"
-//#include "RRCConnectionSetup.h"
-//#include "SRB-ToAddModList.h"
-//#include "DRB-ToAddModList.h"
-//#if defined(Rel10) || defined(Rel14)
-//#include "MCCH-Message.h"
-////#define MRB1 1
-//#endif
-//#include "RRC/LITE/defs.h"
-//#include "RRCConnectionSetupComplete.h"
-//#include "RRCConnectionReconfigurationComplete.h"
-//#include "RRCConnectionReconfiguration.h"
-//#include "MasterInformationBlock.h"
-//#include "SystemInformation.h"
-//#include "SystemInformationBlockType1.h"
-//#include "SIB-Type.h"
-//#include "BCCH-DL-SCH-Message.h"
 //#include for NB-IoT-------------------
 #include "RRCConnectionRequest-NB.h"
@@ -93,13 +71,10 @@
 #include "SIB-Type-NB-r13.h"
 #include "RRCConnectionResume-NB.h"
 #include "RRCConnectionReestablishment-NB.h"
 //----------------------------------------
 #include "PHY/defs.h"
-//#include "MeasObjectToAddModList.h"
-//#include "ReportConfigToAddModList.h"
-//#include "MeasIdToAddModList.h"
 #include "enb_config.h"
 #if defined(ENABLE_ITTI)
@@ -119,94 +94,94 @@ int errno;
-//Not touched
+////Not touched
-//#define XER_PRINT
+////#define XER_PRINT
-extern Enb_properties_array_t enb_properties;
+//extern Enb_properties_array_t enb_properties;
-typedef struct xer_sprint_string_s {
+//typedef struct xer_sprint_string_s {
-  char *string;
+//  char *string;
-  size_t string_size;
+//  size_t string_size;
-  size_t string_index;
+//  size_t string_index;
-} xer_sprint_string_t;
+//} xer_sprint_string_t;
+//
-extern unsigned char NB_eNB_INST;
+//extern unsigned char NB_eNB_INST;
-extern uint8_t usim_test;
+//extern uint8_t usim_test;
-uint16_t two_tier_hexagonal_cellIds[7] = {0,1,2,4,5,7,8};
+//uint16_t two_tier_hexagonal_cellIds[7] = {0,1,2,4,5,7,8};
-uint16_t two_tier_hexagonal_adjacent_cellIds[7][6] = {{1,2,4,5,7,8},    // CellId 0
+//uint16_t two_tier_hexagonal_adjacent_cellIds[7][6] = {{1,2,4,5,7,8},    // CellId 0
-  {11,18,2,0,8,15}, // CellId 1
+//  {11,18,2,0,8,15}, // CellId 1
-  {18,13,3,4,0,1},  // CellId 2
+//  {18,13,3,4,0,1},  // CellId 2
-  {2,3,14,6,5,0},   // CellId 4
+//  {2,3,14,6,5,0},   // CellId 4
-  {0,4,6,16,9,7},   // CellId 5
+//  {0,4,6,16,9,7},   // CellId 5
-  {8,0,5,9,17,12},  // CellId 7
+//  {8,0,5,9,17,12},  // CellId 7
-  {15,1,0,7,12,10}
+//  {15,1,0,7,12,10}
-};// CellId 8
+//};// CellId 8
-/*
+///*
- * This is a helper function for xer_sprint, which directs all incoming data
+// * This is a helper function for xer_sprint, which directs all incoming data
- * into the provided string.
+// * into the provided string.
- */
+// */
-static int xer__print2s (const void *buffer, size_t size, void *app_key)
+//static int xer__print2s (const void *buffer, size_t size, void *app_key)
-{
+//{
-  xer_sprint_string_t *string_buffer = (xer_sprint_string_t *) app_key;
+//  xer_sprint_string_t *string_buffer = (xer_sprint_string_t *) app_key;
-  size_t string_remaining = string_buffer->string_size - string_buffer->string_index;
+//  size_t string_remaining = string_buffer->string_size - string_buffer->string_index;
+//
-  if (string_remaining > 0) {
+//  if (string_remaining > 0) {
-    if (size > string_remaining) {
+//    if (size > string_remaining) {
-      size = string_remaining;
+//      size = string_remaining;
-    }
+//    }
+//
-    memcpy(&string_buffer->string[string_buffer->string_index], buffer, size);
+//    memcpy(&string_buffer->string[string_buffer->string_index], buffer, size);
-    string_buffer->string_index += size;
+//    string_buffer->string_index += size;
-  }
+//  }
+//
-  return 0;
+//  return 0;
-}
+//}
-int xer_sprint (char *string, size_t string_size, asn_TYPE_descriptor_t *td, void *sptr)
-{
-  asn_enc_rval_t er;
-  xer_sprint_string_t string_buffer;
-  string_buffer.string = string;
-  string_buffer.string_size = string_size;
-  string_buffer.string_index = 0;
-  er = xer_encode(td, sptr, XER_F_BASIC, xer__print2s, &string_buffer);
-  if (er.encoded < 0) {
-    LOG_E(RRC, "xer_sprint encoding error (%d)!", er.encoded);
-    er.encoded = string_buffer.string_size;
-  } else {
-    if (er.encoded > string_buffer.string_size) {
-      LOG_E(RRC, "xer_sprint string buffer too small, got %d need %d!", string_buffer.string_size, er.encoded);
-      er.encoded = string_buffer.string_size;
-    }
-  }
-  return er.encoded;
-}
-uint16_t get_adjacent_cell_id(uint8_t Mod_id,uint8_t index)
-{
-  return(two_tier_hexagonal_adjacent_cellIds[Mod_id][index]);
-}
-/* This only works for the hexagonal topology...need a more general function for other topologies */
-uint8_t get_adjacent_cell_mod_id(uint16_t phyCellId)
-{
-  uint8_t i;
-  for(i=0; i<7; i++) {
-    if(two_tier_hexagonal_cellIds[i] == phyCellId) {
-      return i;
-    }
-  }
-  LOG_E(RRC,"\nCannot get adjacent cell mod id! Fatal error!\n");
+//int xer_sprint (char *string, size_t string_size, asn_TYPE_descriptor_t *td, void *sptr)
-  return 0xFF; //error!
+//{
-}
+//  asn_enc_rval_t er;
+//  xer_sprint_string_t string_buffer;
+//
+//  string_buffer.string = string;
+//  string_buffer.string_size = string_size;
+//  string_buffer.string_index = 0;
+//
+//  er = xer_encode(td, sptr, XER_F_BASIC, xer__print2s, &string_buffer);
+//
+//  if (er.encoded < 0) {
+//    LOG_E(RRC, "xer_sprint encoding error (%d)!", er.encoded);
+//    er.encoded = string_buffer.string_size;
+//  } else {
+//    if (er.encoded > string_buffer.string_size) {
+//      LOG_E(RRC, "xer_sprint string buffer too small, got %d need %d!", string_buffer.string_size, er.encoded);
+//      er.encoded = string_buffer.string_size;
+//    }
+//  }
+//
+//  return er.encoded;
+//}
+//uint16_t get_adjacent_cell_id(uint8_t Mod_id,uint8_t index)
+//{
+//  return(two_tier_hexagonal_adjacent_cellIds[Mod_id][index]);
+//}
+///* This only works for the hexagonal topology...need a more general function for other topologies */
+//
+//uint8_t get_adjacent_cell_mod_id(uint16_t phyCellId)
+//{
+//  uint8_t i;
+//
+//  for(i=0; i<7; i++) {
+//    if(two_tier_hexagonal_cellIds[i] == phyCellId) {
+//      return i;
+//    }
+//  }
+//
+//  LOG_E(RRC,"\nCannot get adjacent cell mod id! Fatal error!\n");
+//  return 0xFF; //error!
+//}
-/*do_MIB_NB*/ //FIXME: to decide lots of things
+/*do_MIB_NB*/
 uint8_t do_MIB_NB(
 		rrc_eNB_carrier_data_NB_t *carrier,
 		uint16_t N_RB_DL,//may not needed--> for NB_IoT only 1 PRB is used
@@ -215,8 +190,22 @@ uint8_t do_MIB_NB(
  asn_enc_rval_t enc_rval;
  BCCH_BCH_Message_NB_t *mib_NB = &(carrier->mib_NB);
-  uint8_t sfn_MSB = (uint8_t)((frame>>2)&0xff); //4 bits FIXME
+  /*
-  uint8_t hsfn_LSB = (uint8_t)((frame>>2)&0xff); //2 bits
+   * systemFrameNumber-MSB: (TS 36.331 pag 576)
+   * define the 4 MSB of the SFN (10 bits). The last significant 6 bits will be acquired implicitly by decoding the NPBCH
+   * NOTE: 6 LSB will be used for counting the 64 radio frames in the TTI period (640 ms) that is exactly the MIB period
+   *
+   * hyperSFN-LSB:
+   * indicates the 2 least significant bits of the HSFN. The remaining 8 bits are present in SIB1-NB
+   * NOTE: with the 2 bits we count the 4 HSFN (is 1 SIB1-Nb modification period) while the other 6 count the number of modification periods
+   *
+   *
+   * NOTE: in OAI never modify the SIB messages!!??
+   */
+  //XXX check if correct the bit assignment
+  uint8_t sfn_MSB = (uint8_t)((frame>>6) & 0x0f); // all the 4 bits are set to 1
+  uint8_t hsfn_LSB = (uint8_t)((frame>>8)& 0x03); //2 bits set to 1
  uint16_t spare=0; //11 bits --> use uint16
  //no DL_Bandwidth, no PCHIC
@@ -234,7 +223,7 @@ uint8_t do_MIB_NB(
  mib_NB->message.spare.bits_unused = 5;
  //decide how to set it
-  mib_NB->message.schedulingInfoSIB1_r13 =0; //see TS 36.213-->tables 16.4.1.3-3 ecc...
+  mib_NB->message.schedulingInfoSIB1_r13 =11; //see TS 36.213-->tables 16.4.1.3-3 ecc...
  mib_NB->message.systemInfoValueTag_r13= 0;
  mib_NB->message.ab_Enabled_r13 = 0;
@@ -247,7 +236,6 @@ uint8_t do_MIB_NB(
         (uint32_t)sfn_MSB,
 		 (uint32_t)hsfn_LSB);
-  //only changes in "asn_DEF_BCCH_BCH_Message_NB"
  enc_rval = uper_encode_to_buffer(&asn_DEF_BCCH_BCH_Message_NB,
                                   (void*)mib_NB,
                                   carrier->MIB_NB,
@@ -286,8 +274,8 @@ uint8_t do_SIB1_NB(uint8_t Mod_id, int CC_id,
  SchedulingInfo_NB_r13_t schedulingInfo_NB;
  SIB_Type_NB_r13_t sib_type_NB;
-  //New parameters
+  //FIXME see if correct
-  //uint8_t hyperSFN_MSB_r13 ?? (BITSTRING)
+  //uint8_t hyperSFN_MSB = (uint8_t) ((frame>>2)& 0xff); --> need to introduce the h_SFN concept to be passed
  long* attachWithoutPDN_Connectivity = NULL;
  attachWithoutPDN_Connectivity = CALLOC(1,sizeof(long));
@@ -305,6 +293,11 @@ uint8_t do_SIB1_NB(uint8_t Mod_id, int CC_id,
  carrier->sib1_NB = &bcch_message->message.choice.c1.choice.systemInformationBlockType1_r13;
  sib1_NB = carrier->sib1_NB;
+  //XXX to be checked
+//  sib1_NB->hyperSFN_MSB_r13.buf = &hyperSFN_MSB;
+//  sib1_NB->hyperSFN_MSB_r13.size = 1;
+//  sib1_NB->hyperSFN_MSB_r13.bits_unused = 0;
  memset(&PLMN_identity_info_NB,0,sizeof(PLMN_IdentityInfo_NB_r13_t));
  memset(&schedulingInfo_NB,0,sizeof(SchedulingInfo_NB_r13_t));
  memset(&sib_type_NB,0,sizeof(SIB_Type_NB_r13_t));
@@ -332,7 +325,7 @@ uint8_t do_SIB1_NB(uint8_t Mod_id, int CC_id,
  PLMN_identity_info_NB.plmn_Identity_r13.mnc.list.size=0;
  PLMN_identity_info_NB.plmn_Identity_r13.mnc.list.count=0;
-  //FIXME
 #if defined(ENABLE_ITTI)
  if (configuration->mnc >= 100) {
@@ -409,7 +402,7 @@ uint8_t do_SIB1_NB(uint8_t Mod_id, int CC_id,
  sib1_NB->cellSelectionInfo_r13.q_RxLevMin_r13=-65; //which value?? TS 36.331 V14.2.1 pag. 589
-  sib1_NB->cellSelectionInfo_r13.q_QualMin_r13 = 0; // FIXME new parameter for SIB1-NB, not present in SIB1
+  sib1_NB->cellSelectionInfo_r13.q_QualMin_r13 = 0; //FIXME new parameter for SIB1-NB, not present in SIB1 (for cell reselection but if not used the UE should apply the default value)
  sib1_NB->p_Max_r13 = CALLOC(1, sizeof(P_Max_t));
  *(sib1_NB->p_Max_r13) = 23;
@@ -419,8 +412,7 @@ uint8_t do_SIB1_NB(uint8_t Mod_id, int CC_id,
 #if defined(ENABLE_ITTI)
    configuration->eutra_band[CC_id];
 #else
-    7; // UL:2500 MHz2570 MHz	DL:2620 MHz	2690 MHz	mode:FDD
+    5; //if not configured we use band 5 (UL: 824 MHz - 849MHz / DL: 869 MHz - 894 MHz  FDD mode)
-       //FIXME For NB-IoT depends on the operation mode (in/out/guard band) and also, not all PRBs are allowed ?
 #endif
    //OPTIONAL new parameters, to be used?
@@ -431,6 +423,7 @@ uint8_t do_SIB1_NB(uint8_t Mod_id, int CC_id,
       * sib1_NB->downlinkBitmap_r13.choice.subframePattern10_r13 =(is a BIT_STRING)
       */
   sib1_NB->downlinkBitmap_r13 = CALLOC(1, sizeof(struct DL_Bitmap_NB_r13));
   (sib1_NB->downlinkBitmap_r13)->present= DL_Bitmap_NB_r13_PR_NOTHING;
@@ -445,7 +438,9 @@ uint8_t do_SIB1_NB(uint8_t Mod_id, int CC_id,
  //FIXME which value to set?
  schedulingInfo_NB.si_Periodicity_r13=SchedulingInfo_NB_r13__si_Periodicity_r13_rf64;
  schedulingInfo_NB.si_RepetitionPattern_r13=SchedulingInfo_NB_r13__si_RepetitionPattern_r13_every2ndRF; //This Indicates the starting radio frames within the SI window used for SI message transmission.
-  schedulingInfo_NB.si_TB_r13= SchedulingInfo_NB_r13__si_TB_r13_b56; //in 2 subframe = 2ms (pag 590 TS 36.331)
+  schedulingInfo_NB.si_TB_r13= SchedulingInfo_NB_r13__si_TB_r13_b208;//208 bits
+  //from ASN1 tools we have seen that sib2 + sib3 we are always below 200 bits so we use this si_TB size.
+  //from the specs the SI-message will be transmitted in 8 subframe = 8ms (pag 590 TS 36.331)
  // This is for SIB2/3
  /*SIB3 --> There is no mapping information of SIB2 since it is always present
@@ -642,7 +637,7 @@ uint8_t do_SIB23_NB(uint8_t Mod_id,
  sib2_NB->radioResourceConfigCommon_r13.npusch_ConfigCommon_r13.srs_SubframeConfig_r13= srs_SubframeConfig;
-  //new (occhio che dmrs_config_r13  un puntatore quando lo richiami)
+  //new (occhio che dmrs_config_r13 � un puntatore quando lo richiami)
  sib2_NB->radioResourceConfigCommon_r13.npusch_ConfigCommon_r13.dmrs_Config_r13->threeTone_CyclicShift_r13 =configuration->npusch_threeTone_CyclicShift_r13[CC_id];
  sib2_NB->radioResourceConfigCommon_r13.npusch_ConfigCommon_r13.dmrs_Config_r13->sixTone_CyclicShift_r13 = configuration->npusch_sixTone_CyclicShift_r13[CC_id];
@@ -752,7 +747,7 @@ uint8_t do_SIB23_NB(uint8_t Mod_id,
       * twelveTone_BaseSequence_r13
-      //new (occhio che dmrs_config_r13  un puntatore quando lo richiami)
+      //new (occhio che dmrs_config_r13 � un puntatore quando lo richiami)
      (*sib2_NB)->radioResourceConfigCommon_r13.npusch_ConfigCommon_r13.dmrs_Config_r13->threeTone_CyclicShift_r13 =0;
      (*sib2_NB)->radioResourceConfigCommon_r13.npusch_ConfigCommon_r13.dmrs_Config_r13->sixTone_CyclicShift_r13 = 0;
@@ -857,7 +852,7 @@ uint8_t do_RRCConnectionSetup_NB(
  int                              CC_id,
  uint8_t*                   const buffer, //Srb0.Tx_buffer.Payload
  const uint8_t                    Transaction_id,
-  const LTE_DL_FRAME_PARMS* const frame_parms, //to be changed or maybe not used
+  const NB_DL_FRAME_PARMS* const frame_parms, // maybe not used
  SRB_ToAddModList_NB_r13_t**             SRB_configList_NB, //for both SRB1bis and SRB1
  struct PhysicalConfigDedicated_NB_r13** physicalConfigDedicated_NB
 )
@@ -975,7 +970,7 @@ uint8_t do_RRCConnectionSetup_NB(
 		 //ADD SRB1bis
 		 //MP: Actually there is no way to distinguish SRB1 and SRB1bis once in the list
-		 //MP: XXX SRB_ToAddModList_NB_r13_t size = 1
+		 //MP: SRB_ToAddModList_NB_r13_t size = 1
 		 ASN_SEQUENCE_ADD(&(*SRB_configList_NB)->list,SRB1bis_config_NB);
@@ -1013,11 +1008,11 @@ uint8_t do_RRCConnectionSetup_NB(
 physicalConfigDedicated2_NB->npdcch_ConfigDedicated_r13->npdcch_StartSF_USS_r13=0;
 // NPUSCH
- physicalConfigDedicated2_NB->npusch_ConfigDedicated_r13->ack_NACK_NumRepetitions_r13= NULL; //(specs pag 643)
+ physicalConfigDedicated2_NB->npusch_ConfigDedicated_r13->ack_NACK_NumRepetitions_r13= NULL; //(specs pag 643) /* OPTIONAL */
 npusch_AllSymbols= CALLOC(1, sizeof(BOOLEAN_t));
 *npusch_AllSymbols= 1; //TRUE
- physicalConfigDedicated2_NB->npusch_ConfigDedicated_r13->npusch_AllSymbols_r13= npusch_AllSymbols;
+ physicalConfigDedicated2_NB->npusch_ConfigDedicated_r13->npusch_AllSymbols_r13= npusch_AllSymbols; /* OPTIONAL */
- physicalConfigDedicated2_NB->npusch_ConfigDedicated_r13->groupHoppingDisabled_r13=NULL;
+ physicalConfigDedicated2_NB->npusch_ConfigDedicated_r13->groupHoppingDisabled_r13=NULL; /* OPTIONAL */
 // UplinkPowerControlDedicated
 physicalConfigDedicated2_NB->uplinkPowerControlDedicated_r13->p0_UE_NPUSCH_r13 = 0; // 0 dB (specs pag 643)
@@ -1027,7 +1022,7 @@ uint8_t do_RRCConnectionSetup_NB(
 rrcConnectionSetup_NB->rrc_TransactionIdentifier = Transaction_id; //input value
 rrcConnectionSetup_NB->criticalExtensions.present = RRCConnectionSetup_NB__criticalExtensions_PR_c1;
 rrcConnectionSetup_NB->criticalExtensions.choice.c1.present =RRCConnectionSetup_NB__criticalExtensions__c1_PR_rrcConnectionSetup_r13 ;
- //XXX: carry only SRB1bis at the moment and phyConfigDedicated
+ //MP: carry only SRB1bis at the moment and phyConfigDedicated
 rrcConnectionSetup_NB->criticalExtensions.choice.c1.choice.rrcConnectionSetup_r13.radioResourceConfigDedicated_r13.srb_ToAddModList_r13 = *SRB_configList_NB;
 rrcConnectionSetup_NB->criticalExtensions.choice.c1.choice.rrcConnectionSetup_r13.radioResourceConfigDedicated_r13.drb_ToAddModList_r13 = NULL;
 rrcConnectionSetup_NB->criticalExtensions.choice.c1.choice.rrcConnectionSetup_r13.radioResourceConfigDedicated_r13.drb_ToReleaseList_r13 = NULL;
@@ -1465,7 +1460,6 @@ uint8_t do_RRCConnectionReestablishment_NB(
 	rrcConnectionReestablishment_NB->criticalExtensions.present = RRCConnectionReestablishment_NB__criticalExtensions_PR_c1;
 	rrcConnectionReestablishment_NB->criticalExtensions.choice.c1.present = RRCConnectionReestablishment_NB__criticalExtensions__c1_PR_rrcConnectionReestablishment_r13;
-	//FIXME: which parameters are needed?
 	rrcConnectionReestablishment_NB->criticalExtensions.choice.c1.choice.rrcConnectionReestablishment_r13.radioResourceConfigDedicated_r13.srb_ToAddModList_r13 = SRB_list_NB;
 	rrcConnectionReestablishment_NB->criticalExtensions.choice.c1.choice.rrcConnectionReestablishment_r13.radioResourceConfigDedicated_r13.drb_ToAddModList_r13 = NULL;
 	rrcConnectionReestablishment_NB->criticalExtensions.choice.c1.choice.rrcConnectionReestablishment_r13.radioResourceConfigDedicated_r13.drb_ToReleaseList_r13 = NULL;

--- a/openair2/RRC/LITE/MESSAGES/asn1_msg_nb_iot.h
+++ b/openair2/RRC/LITE/MESSAGES/asn1_msg_nb_iot.h
@@ -52,17 +52,9 @@
 * RETURN VALUES:
 *       0: The structure is printed.
 *      -1: Problem printing the structure.
- * WARNING: No sensible errno value is returned.
+ * WARNING: No sensible error value is returned.
 */
-//not touched
-int xer_sprint(char *string, size_t string_size, struct asn_TYPE_descriptor_s *td, void *sptr);
-//not touched
-uint16_t get_adjacent_cell_id(uint8_t Mod_id,uint8_t index);
-//Not touched
-uint8_t get_adjacent_cell_mod_id(uint16_t phyCellId);
 /**
 \brief Generate configuration for SIB1 (eNB).

--- a/openair2/RRC/LITE/extern_nb_iot.h
+++ b/openair2/RRC/LITE/extern_nb_iot.h
@@ -47,6 +47,13 @@ extern uint8_t DRB2LCHAN_NB[2];
 extern LogicalChannelConfig_NB_r13_t SRB1bis_NB_logicalChannelConfig_defaultValue;
 extern LogicalChannelConfig_NB_r13_t SRB1_NB_logicalChannelConfig_defaultValue;
+extern uint16_t T300_NB[8];
+extern uint16_t T301_NB[8];
+extern uint16_t T310_NB[8];
+extern uint16_t T311_NB[8];
+extern uint16_t N310_NB[8];
+extern uint16_t N311_NB[8];
 #endif
--- a/openair2/RRC/LITE/proto_nb_iot.h
+++ b/openair2/RRC/LITE/proto_nb_iot.h
@@ -127,6 +127,7 @@ int8_t NB_mac_rrc_data_req_eNB(
  const int         CC_id,
  const frame_t     frameP,
  const frame_t		h_frameP,
+  const sub_frame_t   subframeP,
  const rb_id_t     Srb_id,
  uint8_t*    const buffer_pP,
  long				schedulingInfoSIB1,//from the mib
@@ -150,6 +151,11 @@ int8_t NB_mac_rrc_data_ind_eNB(
 );
 //-------------------------------------------
+//defined in L2_interface
+void dump_ue_list_NB(UE_list_NB_t *listP, int ul_flag);
+//-------------------------------------------
 //defined in L2_interface
 void NB_mac_eNB_rrc_ul_failure(
 		const module_id_t mod_idP,
@@ -179,7 +185,22 @@ int NB_mac_eNB_get_rrc_status(
 );
 //---------------------------
-//FIXME for the moment we not configure PDCP for SRB1bis (but used as it is SRB1)
+//----------------------------------------
+int
+NB_pdcp_apply_security(
+  const protocol_ctxt_t* const ctxt_pP,
+  pdcp_t        *const pdcp_pP,
+  const srb_flag_t     srb_flagP,
+  const rb_id_t        rb_id, //rb_idP % maxDRB_NB_r13
+  const uint8_t        pdcp_header_len,
+  const uint16_t       current_sn,
+  uint8_t       * const pdcp_pdu_buffer,
+  const uint16_t      sdu_buffer_size
+);
+//-------------------------------------------
+//XXX for the moment we not configure PDCP for SRB1bis (but used as it is SRB1)
 //defined in pdcp.c
 boolean_t NB_rrc_pdcp_config_asn1_req (
  const protocol_ctxt_t* const  ctxt_pP,
@@ -279,7 +300,7 @@ NB_rlc_am_configure(
  rlc_am_entity_t *const        rlc_pP,
  const uint16_t                max_retx_thresholdP,
  const uint16_t                t_poll_retransmitP,
-  const uint16_t* const			enableStatusReportSN_Gap
+  const uint32_t* const			enableStatusReportSN_Gap
  );
 //--------------------------------------------------------------
@@ -413,9 +434,7 @@ tbs_size_t NB_mac_rlc_data_req_eNB(
-/*UE procedures*/
+/*-----------eNB procedures (rrc_eNB_nb_iot.c)---------------*/
-/*eNB procedures*/
 //---Initialization--------------
 void
@@ -535,6 +554,12 @@ rrc_eNB_generate_defaultRRCConnectionReconfiguration_NB(const protocol_ctxt_t* c
 /// Utilities------------------------------------------------
+void
+rrc_eNB_free_UE_NB(
+		const module_id_t enb_mod_idP,
+		const struct rrc_eNB_ue_context_NB_s*        const ue_context_pP
+		);
 void
 rrc_eNB_free_mem_UE_context_NB(
  const protocol_ctxt_t*               const ctxt_pP,

--- a/openair2/RRC/LITE/rrc_common_nb_iot.c
+++ b/openair2/RRC/LITE/rrc_common_nb_iot.c
@@ -54,11 +54,59 @@ extern mui_t rrc_eNB_mui;
 /*missed functions*/
 //rrc_top_cleanup
-//rrc_t310_expiration
 //binary_search_init
 //binary_search_float
+//--------------
+//MP: Most probably is not needed (old code)
+//-----------------------------------------------------------------------------
+void
+rrc_t310_expiration_NB(
+  const protocol_ctxt_t* const ctxt_pP,
+  const uint8_t                 eNB_index
+)
+//-----------------------------------------------------------------------------
+{
+  if (UE_rrc_inst[ctxt_pP->module_id].Info[eNB_index].State != RRC_CONNECTED) {
+    LOG_D(RRC, "Timer 310 expired, going to RRC_IDLE\n");
+    UE_rrc_inst[ctxt_pP->module_id].Info[eNB_index].State = RRC_IDLE;
+    UE_rrc_inst[ctxt_pP->module_id].Info[eNB_index].UE_index = 0xffff;
+    UE_rrc_inst[ctxt_pP->module_id].Srb0[eNB_index].Rx_buffer.payload_size = 0;
+    UE_rrc_inst[ctxt_pP->module_id].Srb0[eNB_index].Tx_buffer.payload_size = 0;
+    UE_rrc_inst[ctxt_pP->module_id].Srb1[eNB_index].Srb_info.Rx_buffer.payload_size = 0;
+    UE_rrc_inst[ctxt_pP->module_id].Srb1[eNB_index].Srb_info.Tx_buffer.payload_size = 0;
+    if (UE_rrc_inst[ctxt_pP->module_id].Srb2[eNB_index].Active == 1) {
+      msg ("[RRC Inst %d] eNB_index %d, Remove RB %d\n ", ctxt_pP->module_id, eNB_index,
+           UE_rrc_inst[ctxt_pP->module_id].Srb2[eNB_index].Srb_info.Srb_id);
+      rrc_pdcp_config_req (ctxt_pP, // MP
+                           SRB_FLAG_YES,
+                           CONFIG_ACTION_REMOVE,
+                           UE_rrc_inst[ctxt_pP->module_id].Srb2[eNB_index].Srb_info.Srb_id,
+                           0);
+      NB_rrc_rlc_config_req(
+    		  	  	  	  	 ctxt_pP,
+							 SRB_FLAG_YES,
+							 CONFIG_ACTION_REMOVE,
+							 UE_rrc_inst[ctxt_pP->module_id].Srb2[eNB_index].Srb_info.Srb_id,
+							 Rlc_info_am);
+      UE_rrc_inst[ctxt_pP->module_id].Srb2[eNB_index].Active = 0;
+      UE_rrc_inst[ctxt_pP->module_id].Srb2[eNB_index].Status = IDLE;
+      UE_rrc_inst[ctxt_pP->module_id].Srb2[eNB_index].Next_check_frame = 0;
+    }
+  } else { // Restablishment procedure
+    LOG_D(RRC, "Timer 310 expired, trying RRCRestablishment ...\n");
+  }
+}
 //configure  BCCH & CCCH Logical Channels and associated rrc_buffers, configure associated SRBs
 //called by openair_rrc_eNB_configuration_NB
 //-----------------------------------------------------------------------------
@@ -251,7 +299,7 @@ rrc_rx_tx_NB(
  int32_t        current_timestamp_ms, ref_timestamp_ms;
  struct timeval ts;
  struct rrc_eNB_ue_context_NB_s   *ue_context_p = NULL;
-  struct rrc_eNB_ue_context_NB_s		  *ue_to_be_removed = NULL;
+  struct rrc_eNB_ue_context_NB_s   *ue_to_be_removed = NULL;
  VCD_SIGNAL_DUMPER_DUMP_FUNCTION_BY_NAME(VCD_SIGNAL_DUMPER_FUNCTIONS_RRC_RX_TX,VCD_FUNCTION_IN);
@@ -304,7 +352,7 @@ rrc_rx_tx_NB(
      if (UE_rrc_inst[ctxt_pP->module_id].Info[enb_indexP].T310_cnt    == T310[UE_rrc_inst[ctxt_pP->module_id].sib2[enb_indexP]->ue_TimersAndConstants.t310]) {
        UE_rrc_inst[ctxt_pP->module_id].Info[enb_indexP].T310_active = 0;
-        rrc_t310_expiration (ctxt_pP, enb_indexP); //FIXME: maybe is required a NB_iot version of this function
+        rrc_t310_expiration_NB (ctxt_pP, enb_indexP); //FIXME: maybe is required a NB_iot version of this function
        VCD_SIGNAL_DUMPER_DUMP_FUNCTION_BY_NAME(VCD_SIGNAL_DUMPER_FUNCTIONS_RRC_RX_TX,VCD_FUNCTION_OUT);
 	LOG_I(RRC,"Returning RRC_PHY_RESYNCH: T310 expired\n");
        return RRC_PHY_RESYNCH;
@@ -389,8 +437,7 @@ rrc_rx_tx_NB(
      }
    }
    if (ue_to_be_removed)
-      rrc_eNB_free_UE(ctxt_pP->module_id,ue_to_be_removed); //FIXME: quite comple procedure, should use the same for NB-IoT?
+    	rrc_eNB_free_UE_NB(ctxt_pP->module_id,ue_to_be_removed);
 //no localization in NB-IoT
    (void)ts; /* remove gcc warning "unused variable" */

--- a/openair2/RRC/LITE/rrc_eNB_UE_context.c
+++ b/openair2/RRC/LITE/rrc_eNB_UE_context.c
@@ -48,17 +48,6 @@ uid_linear_allocator_init(
  memset(uid_pP, 0, sizeof(uid_allocator_t));
 }
-//------------------------------------------------------------------------------
-void
-uid_linear_allocator_init_NB(
-  uid_allocator_NB_t* const uid_pP
-)
-//------------------------------------------------------------------------------
-{
-  memset(uid_pP, 0, sizeof(uid_allocator_NB_t));
-}
 //------------------------------------------------------------------------------
 uid_t
 uid_linear_allocator_new(
@@ -166,7 +155,145 @@ rrc_eNB_get_ue_context(
 }
-//--(NB-IoT implementation)-----------------------------------------------------
+//------------------------------------------------------------------------------
+void rrc_eNB_remove_ue_context(
+  const protocol_ctxt_t* const ctxt_pP,
+  eNB_RRC_INST*                rrc_instance_pP,
+  struct rrc_eNB_ue_context_s* ue_context_pP)
+//------------------------------------------------------------------------------
+{
+  if (rrc_instance_pP == NULL) {
+    LOG_E(RRC, PROTOCOL_RRC_CTXT_UE_FMT" Bad RRC instance\n",
+          PROTOCOL_RRC_CTXT_UE_ARGS(ctxt_pP));
+    return;
+  }
+  if (ue_context_pP == NULL) {
+    LOG_E(RRC, PROTOCOL_RRC_CTXT_UE_FMT" Trying to free a NULL UE context\n",
+          PROTOCOL_RRC_CTXT_UE_ARGS(ctxt_pP));
+    return;
+  }
+  RB_REMOVE(rrc_ue_tree_s, &rrc_instance_pP->rrc_ue_head, ue_context_pP);
+  MSC_LOG_EVENT(
+    MSC_RRC_ENB,
+    "0 Removed UE %"PRIx16" ",
+    ue_context_pP->ue_context.rnti);
+  rrc_eNB_free_mem_UE_context(ctxt_pP, ue_context_pP);
+  uid_linear_allocator_free(rrc_instance_pP, ue_context_pP->local_uid);
+  free(ue_context_pP);
+  LOG_I(RRC,
+        PROTOCOL_RRC_CTXT_UE_FMT" Removed UE context\n",
+        PROTOCOL_RRC_CTXT_UE_ARGS(ctxt_pP));
+}
+//--------------------NB-IoT version----------------------------
+//------------------------------------------------------------------------------
+void
+uid_linear_allocator_init_NB(
+  uid_allocator_NB_t* const uid_pP
+)
+//------------------------------------------------------------------------------
+{
+  memset(uid_pP, 0, sizeof(uid_allocator_NB_t));
+}
+//------------------------------------------------------------------------------
+uid_t
+uid_linear_allocator_new_NB(
+  eNB_RRC_INST_NB* const rrc_instance_pP
+)
+//------------------------------------------------------------------------------
+{
+  unsigned int i;
+  unsigned int bit_index = 1;
+  uid_t        uid = 0;
+  uid_allocator_NB_t* uia_p = &rrc_instance_pP->uid_allocator;
+  for (i=0; i < UID_LINEAR_ALLOCATOR_BITMAP_SIZE; i++) {
+    if (uia_p->bitmap[i] != UINT_MAX) {
+      bit_index = 1;
+      uid       = 0;
+      while ((uia_p->bitmap[i] & bit_index) == bit_index) {
+        bit_index = bit_index << 1;
+        uid       += 1;
+      }
+      uia_p->bitmap[i] |= bit_index;
+      return uid + (i*sizeof(unsigned int)*8);
+    }
+  }
+  return UINT_MAX;
+}
+//------------------------------------------------------------------------------
+void
+uid_linear_allocator_free_NB(
+  eNB_RRC_INST_NB* rrc_instance_pP,
+  uid_t uidP
+)
+//------------------------------------------------------------------------------
+{
+  unsigned int i = uidP/sizeof(unsigned int)/8;
+  unsigned int bit = uidP % (sizeof(unsigned int) * 8);
+  unsigned int value = ~(0x00000001 << bit);
+  if (i < UID_LINEAR_ALLOCATOR_BITMAP_SIZE) {
+    rrc_instance_pP->uid_allocator.bitmap[i] &=  value;
+  }
+}
+int rrc_eNB_compare_ue_rnti_id_NB(
+  struct rrc_eNB_ue_context_NB_s* c1_pP, struct rrc_eNB_ue_context_NB_s* c2_pP)
+//------------------------------------------------------------------------------
+{
+  if (c1_pP->ue_id_rnti > c2_pP->ue_id_rnti) {
+    return 1;
+  }
+  if (c1_pP->ue_id_rnti < c2_pP->ue_id_rnti) {
+    return -1;
+  }
+  return 0;
+}
+/* Generate the tree management functions for NB-IoT structures */
+RB_GENERATE(rrc_ue_tree_NB_s, rrc_eNB_ue_context_NB_s, entries,
+            rrc_eNB_compare_ue_rnti_id_NB);
+//------------------------------------------------------------------------------
+struct rrc_eNB_ue_context_NB_s*
+rrc_eNB_allocate_new_UE_context_NB(
+  eNB_RRC_INST_NB* rrc_instance_pP
+)
+//------------------------------------------------------------------------------
+{
+  struct rrc_eNB_ue_context_NB_s* new_p;
+  new_p = malloc(sizeof(struct rrc_eNB_ue_context_NB_s));
+  if (new_p == NULL) {
+    LOG_E(RRC, "Cannot allocate new ue context\n");
+    return NULL;
+  }
+  memset(new_p, 0, sizeof(struct rrc_eNB_ue_context_NB_s));
+  new_p->local_uid = uid_linear_allocator_new_NB(rrc_instance_pP);
+  return new_p;
+}
 struct rrc_eNB_ue_context_NB_s*
 rrc_eNB_get_ue_context_NB(
  eNB_RRC_INST_NB* rrc_instance_pP,
@@ -177,15 +304,14 @@ rrc_eNB_get_ue_context_NB(
  memset(&temp, 0, sizeof(struct rrc_eNB_ue_context_NB_s));
  /* eNB ue rrc id = 24 bits wide */
  temp.ue_id_rnti = rntiP;
-  return RB_FIND(rrc_ue_tree_s, &rrc_instance_pP->rrc_ue_head, &temp);
+  return RB_FIND(rrc_ue_tree_NB_s, &rrc_instance_pP->rrc_ue_head, &temp);
 }
 //------------------------------------------------------------------------------
-void rrc_eNB_remove_ue_context(
+void rrc_eNB_remove_ue_context_NB(
  const protocol_ctxt_t* const ctxt_pP,
-  eNB_RRC_INST*                rrc_instance_pP,
+  eNB_RRC_INST_NB*                rrc_instance_pP,
-  struct rrc_eNB_ue_context_s* ue_context_pP)
+  struct rrc_eNB_ue_context_NB_s* ue_context_pP)
 //------------------------------------------------------------------------------
 {
  if (rrc_instance_pP == NULL) {
@@ -200,15 +326,15 @@ void rrc_eNB_remove_ue_context(
    return;
  }
-  RB_REMOVE(rrc_ue_tree_s, &rrc_instance_pP->rrc_ue_head, ue_context_pP);
+  RB_REMOVE(rrc_ue_tree_NB_s, &rrc_instance_pP->rrc_ue_head, ue_context_pP);
  MSC_LOG_EVENT(
    MSC_RRC_ENB,
    "0 Removed UE %"PRIx16" ",
    ue_context_pP->ue_context.rnti);
-  rrc_eNB_free_mem_UE_context(ctxt_pP, ue_context_pP);
+  rrc_eNB_free_mem_UE_context_NB(ctxt_pP, ue_context_pP);
-  uid_linear_allocator_free(rrc_instance_pP, ue_context_pP->local_uid);
+  uid_linear_allocator_free_NB(rrc_instance_pP, ue_context_pP->local_uid);
  free(ue_context_pP);
  LOG_I(RRC,
        PROTOCOL_RRC_CTXT_UE_FMT" Removed UE context\n",
@@ -216,3 +342,9 @@ void rrc_eNB_remove_ue_context(
 }
--- a/openair2/RRC/LITE/rrc_eNB_UE_context.h
+++ b/openair2/RRC/LITE/rrc_eNB_UE_context.h
@@ -39,6 +39,7 @@ uid_linear_allocator_init(
  uid_allocator_t* const uid_pP
 );
 uid_t
 uid_linear_allocator_new(
  eNB_RRC_INST* rrc_instance_pP
@@ -72,11 +73,6 @@ rrc_eNB_get_ue_context(
  rnti_t rntiP
 );
-//NB-IoT
-struct rrc_eNB_ue_context_NB_s*
-rrc_eNB_get_ue_context_NB(
-  eNB_RRC_INST_NB* rrc_instance_pP,
-  rnti_t rntiP);
 void rrc_eNB_remove_ue_context(
  const protocol_ctxt_t* const ctxt_pP,
@@ -84,4 +80,46 @@ void rrc_eNB_remove_ue_context(
  struct rrc_eNB_ue_context_s* ue_context_pP
 );
+//-----NB-IoT-----------------------
+void
+uid_linear_allocator_init_NB(
+  uid_allocator_NB_t* const uid_pP
+);
+uid_t
+uid_linear_allocator_new_NB(
+  eNB_RRC_INST_NB* const rrc_instance_pP
+);
+void
+uid_linear_allocator_free_NB(
+  eNB_RRC_INST_NB* rrc_instance_pP,
+  uid_t uidP
+);
+int rrc_eNB_compare_ue_rnti_id_NB(
+  struct rrc_eNB_ue_context_NB_s* c1_pP, struct rrc_eNB_ue_context_NB_s* c2_pP);
+RB_PROTOTYPE(rrc_ue_tree_NB_s, rrc_eNB_ue_context_NB_s, entries, rrc_eNB_compare_ue_rnti_id_NB);
+struct rrc_eNB_ue_context_NB_s*
+rrc_eNB_allocate_new_UE_context_NB(
+  eNB_RRC_INST_NB* rrc_instance_pP
+);
+struct rrc_eNB_ue_context_NB_s*
+rrc_eNB_get_ue_context_NB(
+  eNB_RRC_INST_NB* rrc_instance_pP,
+  rnti_t rntiP);
+void rrc_eNB_remove_ue_context_NB(
+  const protocol_ctxt_t* const ctxt_pP,
+  eNB_RRC_INST_NB*                rrc_instance_pP,
+  struct rrc_eNB_ue_context_NB_s* ue_context_pP);
 #endif
--- a/openair2/RRC/LITE/rrc_eNB_nb_iot.c
+++ b/openair2/RRC/LITE/rrc_eNB_nb_iot.c
@@ -39,6 +39,7 @@
 #include "DL-CCCH-Message-NB.h"
 #include "UL-DCCH-Message-NB.h"
 #include "DL-DCCH-Message-NB.h"
+#include "SRB-ToAddMod-NB-r13.h"
 #include "extern.h"
 #include "extern_nb_iot.h"
@@ -49,16 +50,6 @@
 #include "LAYER2/MAC/proto.h"
 #include "UTIL/LOG/log.h"
 #include "COMMON/mac_rrc_primitives.h"
-//#include "RRC/LITE/MESSAGES/asn1_msg.h"
-//#include "RRCConnectionRequest.h"
-//#include "RRCConnectionReestablishmentRequest.h"
-//#include "ReestablishmentCause.h"
-//#include "UL-CCCH-Message.h"
-//#include "DL-CCCH-Message.h"
-//#include "UL-DCCH-Message.h"
-//#include "DL-DCCH-Message.h"
-//#include "TDD-Config.h"
-//#include "HandoverCommand.h"
 #include "rlc.h"
 #include "SIMULATION/ETH_TRANSPORT/extern.h"
 #include "rrc_eNB_UE_context.h"
@@ -66,7 +57,6 @@
 #include "msc.h"
 #include "T.h"
-//FIXME: MP: once defined properly the MAC/defs_nb_iot this should be deleted
 #include "LAYER2/MAC/defs.h"
 #include "LAYER2/MAC/defs_nb_iot.h"
@@ -113,12 +103,68 @@ extern UE_MAC_INST                 *UE_mac_inst;
 extern void*                        bigphys_malloc(int);
 #endif
-extern uint16_t                     two_tier_hexagonal_cellIds[7];
-mui_t                               rrc_eNB_mui = 0;
+/*the Message Unit Identifieer (MUI) is an Identity of the RLC SDU, whic is used to indicate which RLC SDU that is confirmed
+ * with the RLC-AM-Data-conf. e.g. ((struct rlc_am_data_req *) (new_sdu_p->data))->mui (NB_rlc_data_req)
+ */
+mui_t                               rrc_eNB_mui_NB = 0;
+// should be called when UE is lost by eNB
+void
+rrc_eNB_free_UE_NB(const module_id_t enb_mod_idP,const struct rrc_eNB_ue_context_NB_s*        const ue_context_pP)
+//-----------------------------------------------------------------------------
+{
+  protocol_ctxt_t                     ctxt;
+#if !defined(ENABLE_USE_MME)
+  module_id_t                         ue_module_id;
+  /* avoid gcc warnings */
+  (void)ue_module_id;
+#endif
+  rnti_t rnti = ue_context_pP->ue_context.rnti;
+  AssertFatal(enb_mod_idP < NB_eNB_INST, "eNB inst invalid (%d/%d) for UE %x!", enb_mod_idP, NB_eNB_INST, rnti);
+  /*  ue_context_p = rrc_eNB_get_ue_context(
+                   &eNB_rrc_inst[enb_mod_idP],
+                   rntiP
+                 );
+  */
+  if (NULL != ue_context_pP) {
+    PROTOCOL_CTXT_SET_BY_MODULE_ID(&ctxt, enb_mod_idP, ENB_FLAG_YES, rnti, 0, 0,enb_mod_idP);
+    LOG_W(RRC, "[eNB %d] Removing UE RNTI %x\n", enb_mod_idP, rnti);
+#if defined(ENABLE_USE_MME)
+    rrc_eNB_send_S1AP_UE_CONTEXT_RELEASE_REQ(enb_mod_idP, ue_context_pP, S1AP_CAUSE_RADIO_NETWORK, 21); // send cause 21: connection with ue lost
+    /* From 3GPP 36300v10 p129 : 19.2.2.2.2 S1 UE Context Release Request (eNB triggered)
+     * If the E-UTRAN internal reason is a radio link failure detected in the eNB, the eNB shall wait a sufficient time before
+     *  triggering the S1 UE Context Release Request procedure
+     *  in order to allow the UE to perform the NAS recovery
+     *  procedure, see TS 23.401 [17].
+     */
+#else
+#if defined(OAI_EMU)
+    AssertFatal(ue_context_pP->local_uid < NUMBER_OF_UE_MAX, "local_uid invalid (%d<%d) for UE %x!", ue_context_pP->local_uid, NUMBER_OF_UE_MAX, rnti);
+    ue_module_id = oai_emulation.info.eNB_ue_local_uid_to_ue_module_id[enb_mod_idP][ue_context_pP->local_uid];
+    AssertFatal(ue_module_id < NUMBER_OF_UE_MAX, "ue_module_id invalid (%d<%d) for UE %x!", ue_module_id, NUMBER_OF_UE_MAX, rnti);
+    oai_emulation.info.eNB_ue_local_uid_to_ue_module_id[enb_mod_idP][ue_context_pP->local_uid] = -1;
+    oai_emulation.info.eNB_ue_module_id_to_rnti[enb_mod_idP][ue_module_id] = NOT_A_RNTI;
+#endif
+#endif
+    rrc_mac_remove_ue(enb_mod_idP,rnti);
+    rrc_rlc_remove_ue(&ctxt);
+    pdcp_remove_UE(&ctxt);
+    rrc_eNB_remove_ue_context_NB(
+      &ctxt,
+      &eNB_rrc_inst_NB[enb_mod_idP],
+      (struct rrc_eNB_ue_context_NB_s*) ue_context_pP);
+  }
+}
 //-----------------------------------------------------------------------------
@@ -156,7 +202,7 @@ rrc_eNB_generate_RRCConnectionRelease_NB(
        PROTOCOL_RRC_CTXT_UE_FMT" --- PDCP_DATA_REQ/%d Bytes (rrcConnectionRelease-NB MUI %d) --->[PDCP][RB %u]\n",
        PROTOCOL_RRC_CTXT_UE_ARGS(ctxt_pP),
        size,
-        rrc_eNB_mui,
+        rrc_eNB_mui_NB,
        DCCH1);//Through SRB1/or SRB1bis
  MSC_LOG_TX_MESSAGE(
@@ -167,13 +213,13 @@ rrc_eNB_generate_RRCConnectionRelease_NB(
    MSC_AS_TIME_FMT" rrcConnectionRelease-NB UE %x MUI %d size %u",
    MSC_AS_TIME_ARGS(ctxt_pP),
    ue_context_pP->ue_context.rnti,
-    rrc_eNB_mui,
+    rrc_eNB_mui_NB,
    size);
  rrc_data_req(
 	       ctxt_pP,
 	       DCCH1,//Through SRB1/or SRB1bis
-	       rrc_eNB_mui++,
+	       rrc_eNB_mui_NB++,
 	       SDU_CONFIRM_NO,
 	       size,
 	       buffer,
@@ -319,7 +365,7 @@ rrc_eNB_get_next_free_ue_context_NB(
        return NULL;
      }
    }
-    ue_context_p = rrc_eNB_allocate_new_UE_context(&eNB_rrc_inst_NB[ctxt_pP->module_id]);
+    ue_context_p = rrc_eNB_allocate_new_UE_context_NB(&eNB_rrc_inst_NB[ctxt_pP->module_id]);
    if (ue_context_p == NULL) {
      LOG_E(RRC,
@@ -460,9 +506,10 @@ rrc_eNB_generate_RRCConnectionSetup_NB(
  int  										cnt;
-  //FIXME: MP: structure to be chaged at phy layer
-  LTE_DL_FRAME_PARMS *fp = mac_xface->get_lte_frame_parms(ctxt_pP->module_id,CC_id);
+  //XXX MP:warning due to function still not completed at PHY (get_lte_frame_parms)
+  //XXX this approach is gone most probably
+  NB_DL_FRAME_PARMS *fp = mac_xface->get_lte_frame_parms(ctxt_pP->module_id,CC_id);
  T(T_ENB_RRC_CONNECTION_SETUP, T_INT(ctxt_pP->module_id), T_INT(ctxt_pP->frame),
    T_INT(ctxt_pP->subframe), T_INT(ctxt_pP->rnti));
@@ -493,8 +540,7 @@ rrc_eNB_generate_RRCConnectionSetup_NB(
  if (*SRB_configList != NULL) {
-	  //XXX MP: srb_identity is no more used in NB-IoT
+	  // MP: the list should contain just one element
-	  //XXX MP: the list should contain just one element
 	  for(cnt = 0; cnt < (*SRB_configList)->list.count; cnt++){
        SRB1bis_config = (*SRB_configList)->list.array[cnt];
@@ -505,7 +551,6 @@ rrc_eNB_generate_RRCConnectionSetup_NB(
            SRB1bis_logicalChannelConfig = &SRB1bis_config->logicalChannelConfig_r13->choice.explicitValue;
          }
          else {
-        	  //XXX MP: warning saying "assignment from incompatible pointer type"
            SRB1bis_logicalChannelConfig = &SRB1bis_NB_logicalChannelConfig_defaultValue;
          	  }
        } else {
@@ -517,9 +562,9 @@ rrc_eNB_generate_RRCConnectionSetup_NB(
              PROTOCOL_RRC_CTXT_UE_ARGS(ctxt_pP));
-        //FIXME: Connection Setup could be called also after security activation
+        //XXX: Maybe some problem if Connection Setup could be called also after security activation
-        //configure the MAC for SRB1bis/SRb1???? (but in principle this configuration should be not LCID dependent)
+        //configure the MAC for SRB1bis/SRb1 (but in principle this configuration should be not LCID dependent)
        NB_rrc_mac_config_req_eNB(
          ctxt_pP->module_id,
          ue_context_pP->ue_context.primaryCC_id,
@@ -656,8 +701,7 @@ rrc_eNB_process_RRCConnectionReconfigurationComplete_NB(
  // set the SRB active in Ue context
  if (SRB_configList2 != NULL) {
-	  //MP: SRB_ToAddModList_NB_r13_t  size = 1 TS 36.331 V14.2.1 pag 615
+	  //MP: SRB_ToAddModList_NB_r13_t  size = 1 TS 36.331 V14.2.1 pag 615  should stop at first iteration
-	  //MP: may for loop is not needed --> should stop at first iteration
    for (i = 0; (i < SRB_configList2->list.count) && (i < 3); i++) {
    	//no need of checking the srb-Identity
@@ -718,7 +762,7 @@ rrc_eNB_process_RRCConnectionReconfigurationComplete_NB(
            dest_ip_offset = 8;
 #      endif
            LOG_I(OIP,
-                  "[eNB %d] Config the oai%d to send/receive pkt on DRB %d to/from the protocol stack\n",
+                  "[eNB %d] Config the oai%d to send/receive pkt on DRB %ld to/from the protocol stack\n",
                  ctxt_pP->module_id, ctxt_pP->module_id,
                  (ue_context_pP->local_uid * maxDRB_NB_r13) + DRB_configList2->list.array[i]->drb_Identity_r13);
            ue_module_id = oai_emulation.info.eNB_ue_local_uid_to_ue_module_id[ctxt_pP->module_id][ue_context_pP->local_uid];
@@ -789,6 +833,8 @@ rrc_eNB_process_RRCConnectionReconfigurationComplete_NB(
                PROTOCOL_RRC_CTXT_UE_FMT" RRC_eNB --- MAC_CONFIG_REQ  (DRB) ---> MAC_eNB\n",
                PROTOCOL_RRC_CTXT_UE_ARGS(ctxt_pP));
+          //MP: The only change w.r.t previous case is that we not put logicalChannelConfig
          NB_rrc_mac_config_req_eNB(
                      ctxt_pP->module_id,
                      ue_context_pP->ue_context.primaryCC_id,
@@ -811,7 +857,7 @@ rrc_eNB_process_RRCConnectionReconfigurationComplete_NB(
                      ue_context_pP->ue_context.physicalConfigDedicated_NB,
                      ue_context_pP->ue_context.mac_MainConfig_NB,
                      DRB2LCHAN_NB[i], //over the logical channel id of the DRB (>=4)
-                      (LogicalChannelConfig_NB_r13_t*)NULL //XXX MP: is the only change w.r.t previous case
+                      (LogicalChannelConfig_NB_r13_t*)NULL
          			);
        }
      }
@@ -822,7 +868,7 @@ rrc_eNB_process_RRCConnectionReconfigurationComplete_NB(
 //-----------------------------------------------------------------------------
 void //was under ITTI
 // This function triggers the establishment of dedicated bearer in the absence of EPC (oaisim case -- noS1)
-// to emulate it only establish 2 bearers (max number for NB-IoT
+// to emulate it only establish 2 bearers (max number for NB-IoT)
 rrc_eNB_reconfigure_DRBs_NB(const protocol_ctxt_t* const ctxt_pP,
 			       rrc_eNB_ue_context_NB_t*  ue_context_pP)
 //------------------------------------------------------------------
@@ -859,7 +905,7 @@ rrc_eNB_reconfigure_DRBs_NB(const protocol_ctxt_t* const ctxt_pP,
  rrc_eNB_generate_dedicatedRRCConnectionReconfiguration_NB(ctxt_pP, ue_context_pP ); //XXX MP: no ho state
 }
 //-----------------------------------------------------------------------------
-uint8_t qci_to_priority[9]={2,4,3,5,1,6,7,8,9}; //FIXME understand if used in NB_IoT (no GBR so only 5-9)
+//uint8_t qci_to_priority[9]={2,4,3,5,1,6,7,8,9};
 //-----------------------------------------------------------------------------
 void //was under ITTI
@@ -943,7 +989,8 @@ rrc_eNB_generate_dedicatedRRCConnectionReconfiguration_NB(
    /*XXX MP:old implementation foresee a switch case on e_context_pP->ue_context.e_rab[i].param.qos.qci (TS 36.413 and TS 23.401)
-     * but in reality since in NB-IoT only RLC-AM mode is allowed we can directly set DRBs whatever the qci
+     * but in reality since in NB-IoT only RLC-AM mode is allowed we can directly configure the DRBs whatever the qci
+     * furthermore, the priority of the SRB is set fix to 1
     */
    // RLC conf
@@ -951,13 +998,13 @@ rrc_eNB_generate_dedicatedRRCConnectionReconfiguration_NB(
    DRB_rlc_config->present = RLC_Config_NB_r13_PR_am;
    DRB_rlc_config->choice.am.ul_AM_RLC_r13.t_PollRetransmit_r13 = T_PollRetransmit_NB_r13_ms250; //random
    DRB_rlc_config->choice.am.ul_AM_RLC_r13.maxRetxThreshold_r13 = UL_AM_RLC_NB_r13__maxRetxThreshold_r13_t8;
-    DRB_rlc_config->choice.am.dl_AM_RLC_r13.enableStatusReportSN_Gap_r13 = CALLOC(1,sizeof(long));
+    DRB_rlc_config->choice.am.dl_AM_RLC_r13.enableStatusReportSN_Gap_r13 = CALLOC(1,sizeof(long)); /* OPTIONAL */
    *(DRB_rlc_config->choice.am.dl_AM_RLC_r13.enableStatusReportSN_Gap_r13)= DL_AM_RLC_NB_r13__enableStatusReportSN_Gap_r13_true;
-    //FIXME MP: TS 36.323 v14.2.0 PDCP status report operation is not applicable for NB-IoT
+    //XXX MP: TS 36.323 v14.2.0 ch5.3.2 PDCP status report operation is not applicable for NB-IoT
    //(in any case they set to FALSE in the LTE DRBs setup in OAI)
-    //MP: not used header compression PDCP in OAI
+    //MP: not used header compression PDCP fr DRBs in OAI
    DRB_pdcp_config->headerCompression_r13.present = PDCP_Config_NB_r13__headerCompression_r13_PR_notUsed;
    DRB_lchan_config = CALLOC(1, sizeof(*DRB_lchan_config));
@@ -967,7 +1014,7 @@ rrc_eNB_generate_dedicatedRRCConnectionReconfiguration_NB(
    *(DRB_lchan_config->priority_r13) = 1L;
-    //DRB_lchan_config->logicalChannelSR_Prohibit_r13 = NULL; /*OPTIONAL*/ --> FIXME not needed to set it now?
+    DRB_lchan_config->logicalChannelSR_Prohibit_r13 = NULL; /*OPTIONAL*/
    //no prioritized bitrate
    //no bucketsize duration
@@ -1062,7 +1109,7 @@ rrc_eNB_generate_dedicatedRRCConnectionReconfiguration_NB(
  LOG_D(RRC,
        "[FRAME %05d][RRC_eNB][MOD %u][][--- PDCP_DATA_REQ/%d Bytes (rrcConnectionReconfiguration to UE %x MUI %d) --->][PDCP][MOD %u][RB %u]\n",
-        ctxt_pP->frame, ctxt_pP->module_id, size, ue_context_pP->ue_context.rnti, rrc_eNB_mui, ctxt_pP->module_id, DCCH1); //through SRB1
+        ctxt_pP->frame, ctxt_pP->module_id, size, ue_context_pP->ue_context.rnti, rrc_eNB_mui_NB, ctxt_pP->module_id, DCCH1); //through SRB1
  MSC_LOG_TX_MESSAGE(
    MSC_RRC_ENB,
@@ -1072,14 +1119,14 @@ rrc_eNB_generate_dedicatedRRCConnectionReconfiguration_NB(
    MSC_AS_TIME_FMT" dedicated rrcConnectionReconfiguration-NB UE %x MUI %d size %u",
    MSC_AS_TIME_ARGS(ctxt_pP),
    ue_context_pP->ue_context.rnti,
-    rrc_eNB_mui,
+    rrc_eNB_mui_NB,
    size);
  //transmit the RRCConnectionReconfiguration-NB
  NB_rrc_data_req(
    ctxt_pP,
    DCCH1,//through SRB1
-    rrc_eNB_mui++,
+    rrc_eNB_mui_NB++,
    SDU_CONFIRM_NO,
    size,
    buffer,
@@ -1113,7 +1160,7 @@ rrc_eNB_process_RRCConnectionSetupComplete_NB(
    rrc_eNB_send_S1AP_NAS_FIRST_REQ(
      ctxt_pP,
      ue_context_pP,
-      rrcConnectionSetupComplete_NB); ///TODO: look at NAS messages
+      rrcConnectionSetupComplete_NB);
  } else
 #endif
  {
@@ -1171,7 +1218,7 @@ rrc_eNB_generate_SecurityModeCommand_NB(
        PROTOCOL_RRC_CTXT_UE_FMT" --- PDCP_DATA_REQ/%d Bytes (securityModeCommand to UE MUI %d) --->[PDCP][RB %02d]\n",
        PROTOCOL_RRC_CTXT_UE_ARGS(ctxt_pP),
        size,
-        rrc_eNB_mui,
+        rrc_eNB_mui_NB,
        DCCH0); //MP: SRB1bis
  MSC_LOG_TX_MESSAGE(
@@ -1182,13 +1229,13 @@ rrc_eNB_generate_SecurityModeCommand_NB(
    MSC_AS_TIME_FMT" securityModeCommand UE %x MUI %d size %u",
    MSC_AS_TIME_ARGS(ctxt_pP),
    ue_context_pP->ue_context.rnti,
-    rrc_eNB_mui,
+    rrc_eNB_mui_NB,
    size);
  NB_rrc_data_req( //to PDCP
 	       ctxt_pP,
 	       DCCH0,//MP:through SRB1bis
-	       rrc_eNB_mui++,
+	       rrc_eNB_mui_NB++,
 	       SDU_CONFIRM_NO,
 	       size,
 	       buffer,
@@ -1204,7 +1251,7 @@ rrc_eNB_generate_UECapabilityEnquiry_NB(
 )
 //-----------------------------------------------------------------------------
 {
-//XXX: Clarify: this message is also called when we receive SecurityModeFailure--> we agree that in any case we start using SRB1
+//MP: this message is also transmitted when we receive SecurityModeFailure--> in any case we start using SRB1
  uint8_t                             buffer[100];
  uint8_t                             size;
@@ -1226,7 +1273,7 @@ rrc_eNB_generate_UECapabilityEnquiry_NB(
        PROTOCOL_RRC_CTXT_UE_FMT" --- PDCP_DATA_REQ/%d Bytes (UECapabilityEnquiry-NB MUI %d) --->[PDCP][RB %02d]\n",
        PROTOCOL_RRC_CTXT_UE_ARGS(ctxt_pP),
        size,
-        rrc_eNB_mui,
+        rrc_eNB_mui_NB,
        DCCH0);//through SRB1bis
  MSC_LOG_TX_MESSAGE(
@@ -1237,17 +1284,17 @@ rrc_eNB_generate_UECapabilityEnquiry_NB(
    MSC_AS_TIME_FMT" rrcUECapabilityEnquiry UE %x MUI %d size %u",
    MSC_AS_TIME_ARGS(ctxt_pP),
    ue_context_pP->ue_context.rnti,
-    rrc_eNB_mui,
+    rrc_eNB_mui_NB,
    size);
  NB_rrc_data_req( //to PDCP
 	       ctxt_pP,
-	       DCCH1, //XXX we send it over SRB1
+	       DCCH1, //MP: send over SRB1
-	       rrc_eNB_mui++,
+	       rrc_eNB_mui_NB++,
 	       SDU_CONFIRM_NO,
 	       size,
 	       buffer,
-	       PDCP_TRANSMISSION_MODE_CONTROL);//XXX MP: no more transparent to PDCP // SRB1 was registered to the pdcp at the beginning
+	       PDCP_TRANSMISSION_MODE_CONTROL);//MP: no more transparent to PDCP -->SRB1 was registered to the pdcp at the beginning
 }
@@ -1264,8 +1311,8 @@ rrc_eNB_generate_defaultRRCConnectionReconfiguration_NB(const protocol_ctxt_t* c
  int                                 i;
  // configure SRB1, PhysicalConfigDedicated, MAC_MainConfig for UE
+  //eNB_RRC_INST_NB*                       rrc_inst = &eNB_rrc_inst_NB[ctxt_pP->module_id];
-  eNB_RRC_INST_NB*                       rrc_inst = &eNB_rrc_inst_NB[ctxt_pP->module_id];
  struct PhysicalConfigDedicated_NB_r13**    physicalConfigDedicated_NB = &ue_context_pP->ue_context.physicalConfigDedicated_NB;
  struct SRB_ToAddMod_NB_r13                           *SRB1_config                      = NULL;
@@ -1278,7 +1325,6 @@ rrc_eNB_generate_defaultRRCConnectionReconfiguration_NB(const protocol_ctxt_t* c
  struct DRB_ToAddMod_NB_r13                *DRB_config                       = NULL;
  struct RLC_Config_NB_r13                  *DRB_rlc_config                   = NULL;
  struct PDCP_Config_NB_r13                 *DRB_pdcp_config                  = NULL;
-  //only AM is supported by NB-IoT
  struct LogicalChannelConfig_NB_r13        *DRB_lchan_config                 = NULL;
  DRB_ToAddModList_NB_r13_t**                DRB_configList = &ue_context_pP->ue_context.DRB_configList;
@@ -1290,7 +1336,7 @@ rrc_eNB_generate_defaultRRCConnectionReconfiguration_NB(const protocol_ctxt_t* c
  long								*enableStatusReportSN_Gap = NULL; //should be disabled
  long								*priority= NULL; //1 for SRB1 and 1 for SRB1bis
  BOOLEAN_t						    *logicalChannelSR_Prohibit = NULL;
-  RSRP_Range_t                       *rsrp                             = NULL; //may not used
+  //RSRP_Range_t                       *rsrp                             = NULL; //may not used
  struct RRCConnectionReconfiguration_NB_r13_IEs__dedicatedInfoNASList_r13 *dedicatedInfoNASList_NB = NULL;
  DedicatedInfoNAS_t                 									   *dedicatedInfoNas        = NULL;
@@ -1332,11 +1378,12 @@ rrc_eNB_generate_defaultRRCConnectionReconfiguration_NB(const protocol_ctxt_t* c
  SRB1_lchan_config->choice.explicitValue.priority_r13 =priority;
  logicalChannelSR_Prohibit = CALLOC(1, sizeof(BOOLEAN_t));
-  *logicalChannelSR_Prohibit = 1;
+  *logicalChannelSR_Prohibit = 1; // is the timer for BSR
-  SRB1_lchan_config->choice.explicitValue.logicalChannelSR_Prohibit_r13 = logicalChannelSR_Prohibit;
+  SRB1_lchan_config->choice.explicitValue.logicalChannelSR_Prohibit_r13 = logicalChannelSR_Prohibit; /* OPTIONAL */
  // this list has the configuration for SRB1 and SRB1bis
  //XXX: Problems ? because SRB_ToAddModList_NB_r13_t max size = 1
+  // should before flush the list??? or directly overwrite
  ASN_SEQUENCE_ADD(&SRB_configList->list, SRB1_config);
  // this list has only the configuration for SRB1
@@ -1399,7 +1446,7 @@ rrc_eNB_generate_defaultRRCConnectionReconfiguration_NB(const protocol_ctxt_t* c
  DRB_lchan_config->priority_r13 = CALLOC(1, sizeof(long));
  *(DRB_lchan_config->priority_r13) = 12; // lower priority than srb1, srb1bis and other dedicated bearer
-  DRB_lchan_config->logicalChannelSR_Prohibit_r13 = logicalChannelSR_Prohibit;//FIXME: for DRB should be used?
+  DRB_lchan_config->logicalChannelSR_Prohibit_r13 = NULL;// is the timer for BSR /* OPTIONAL */
  //Add the DRB in both list
  ASN_SEQUENCE_ADD(&(*DRB_configList)->list, DRB_config);
@@ -1432,19 +1479,16 @@ rrc_eNB_generate_defaultRRCConnectionReconfiguration_NB(const protocol_ctxt_t* c
 		  MAC_MainConfig_NB_r13__logicalChannelSR_Config_r13__setup__logicalChannelSR_ProhibitTimer_r13_pp2; //value in PP=PDCCH periods
-  struct PhysicalConfigDedicated ciao;
  if (*physicalConfigDedicated_NB) {
 	  //TODO: which value should be configured of phisical config dedicated?
 	  //antennaInfo not present in PhysicalConfigDedicated for NB_IoT
      //cqi reporting is not present in PhysicalConfigDedicated for NB_IoT
-	  /*
-	   * carrierConfigDedicated_r13
+	   //* carrierConfigDedicated_r13 /* OPTIONAL */
-	   * npdcch_ConfigDedicated_r13
+	   //* npdcch_ConfigDedicated_r13 /* OPTIONAL */
-	   * npusch_ConfigDedicated_r13
+	   //* npusch_ConfigDedicated_r13 /* OPTIONAL */
-	   * uplinkPowerControlDedicated_r13
+	   //* uplinkPowerControlDedicated_r13 /* OPTIONAL */
-	   */
  }
  else {
    LOG_E(RRC,"physical_config_dedicated not present in RRCConnectionReconfiguration-NB. Not reconfiguring!\n");
@@ -1531,7 +1575,7 @@ rrc_eNB_generate_defaultRRCConnectionReconfiguration_NB(const protocol_ctxt_t* c
  LOG_D(RRC,
        "[FRAME %05d][RRC_eNB][MOD %u][][--- PDCP_DATA_REQ/%d Bytes (rrcConnectionReconfiguration-NB to UE %x MUI %d) --->][PDCP][MOD %u][RB %u]\n",
-        ctxt_pP->frame, ctxt_pP->module_id, size, ue_context_pP->ue_context.rnti, rrc_eNB_mui, ctxt_pP->module_id, DCCH1);//through SRB1
+        ctxt_pP->frame, ctxt_pP->module_id, size, ue_context_pP->ue_context.rnti, rrc_eNB_mui_NB, ctxt_pP->module_id, DCCH1);//through SRB1
  MSC_LOG_TX_MESSAGE(
    MSC_RRC_ENB,
@@ -1541,13 +1585,13 @@ rrc_eNB_generate_defaultRRCConnectionReconfiguration_NB(const protocol_ctxt_t* c
    MSC_AS_TIME_FMT" rrcConnectionReconfiguration-NB UE %x MUI %d size %u",
    MSC_AS_TIME_ARGS(ctxt_pP),
    ue_context_pP->ue_context.rnti,
-    rrc_eNB_mui,
+    rrc_eNB_mui_NB,
    size);
  NB_rrc_data_req( //to PDCP
 	       ctxt_pP,
 	       DCCH1,//through SRB1
-	       rrc_eNB_mui++,
+	       rrc_eNB_mui_NB++,
 	       SDU_CONFIRM_NO,
 	       size,
 	       buffer,
@@ -1594,7 +1638,7 @@ init_SI_NB(
  {
 	  eNB_rrc_inst_NB[ctxt_pP->module_id].carrier[CC_id].sizeof_MIB_NB =
 	  			  do_MIB_NB(&eNB_rrc_inst_NB[ctxt_pP->module_id].carrier[CC_id],
-	  					  	configuration->N_RB_DL,
+	  					  	configuration->N_RB_DL[CC_id],
 					        0
 					        );
  }
@@ -1686,10 +1730,10 @@ init_SI_NB(
 								eNB_rrc_inst_NB[ctxt_pP->module_id].carrier[CC_id].mib_NB,
 								(RadioResourceConfigCommonSIB_NB_r13_t *) &
 								eNB_rrc_inst_NB[ctxt_pP->module_id].carrier[CC_id].sib2_NB->radioResourceConfigCommon_r13,
-								(struct PhysicalConfigDedicated_NB_r13_t *)NULL,
+								(struct PhysicalConfigDedicated_NB_r13 *)NULL,
 								(MAC_MainConfig_NB_r13_t *) NULL,
 								0,// MP:logicalChannelID  //TODO still have to be properly managed in the interface
-								(struct LogicalChannelConfig_NB_r13_t *)NULL
+								(struct LogicalChannelConfig_NB_r13 *)NULL
 								);
  } else {
    LOG_E(RRC, PROTOCOL_RRC_CTXT_FMT" init_SI: FATAL, no memory for SIB2/3_NB allocated\n",
@@ -1703,7 +1747,7 @@ init_SI_NB(
 char
 openair_rrc_eNB_configuration_NB(
  const module_id_t enb_mod_idP,
-  RrcConfigurationReq* configuration //FIXME MP: previously was insiede ITTI but actually I put it out
+  RrcConfigurationReq* configuration //MP: previously was insiede ITTI but actually I put it out
 )
 //-----------------------------------------------------------------------------
 {
@@ -1757,10 +1801,7 @@ while ( eNB_rrc_inst_NB == NULL ) {
  //rrc_init_global_param_NB();
  //XXX following the old implementation: openair_rrc_top_init is called in MAC/main.c
+  //In Rymond version actually is called here
-  //FIXME: this probably would create some bug for the following reaon:
-  //in the onld implementation this function was called in the MAC/main.c
-  //actually is called here --> we are allocating memory so maybe we generate some problems
  //openair_rrc_top_init_eNB_NB();
@@ -1783,7 +1824,6 @@ rrc_eNB_decode_ccch_NB(
 )
 //-----------------------------------------------------------------------------
 {
-  module_id_t                                   Idx;
  asn_dec_rval_t                      dec_rval;
  UL_CCCH_Message_NB_t                  *ul_ccch_msg_NB = NULL;
  RRCConnectionRequest_NB_r13_IEs_t                *rrcConnectionRequest_NB = NULL;
@@ -1869,7 +1909,7 @@ rrc_eNB_decode_ccch_NB(
             "reconfigurationFailure"));
-     //FIXME:connection reestablishment to be implemented
+     //TODO:connection reestablishment to be implemented
      /*{
      uint64_t                            c_rnti = 0;
@@ -1887,7 +1927,7 @@ rrc_eNB_decode_ccch_NB(
      */
      /* reject all reestablishment attempts for the moment */
-      //for the moment we only reject
+      //MP:for the moment we only reject
      rrc_eNB_generate_RRCConnectionReestablishmentReject_NB(ctxt_pP,
                       rrc_eNB_get_ue_context_NB(&eNB_rrc_inst_NB[ctxt_pP->module_id], ctxt_pP->rnti),
                       CC_id);
@@ -1984,7 +2024,7 @@ rrc_eNB_decode_ccch_NB(
 	      LOG_I(RRC," S-TMSI doesn't exist, setting Initialue_identity_s_TMSI.m_tmsi to %p => %x\n",ue_context_p,m_tmsi);
              ue_context_p = rrc_eNB_get_next_free_ue_context_NB(ctxt_pP, NOT_A_RANDOM_UE_IDENTITY);
              if (ue_context_p == NULL)
-                LOG_E(RRC, "%s:%d:%s: rrc_eNB_get_next_free_ue_context returned NULL\n", __FILE__, __LINE__, __FUNCTION__);
+                LOG_E(RRC, "%s:%d:%s: rrc_eNB_get_next_free_ue_context_NB returned NULL\n", __FILE__, __LINE__, __FUNCTION__);
              if (ue_context_p != NULL) {
 	        ue_context_p->ue_context.Initialue_identity_s_TMSI.presence = TRUE;
 	        ue_context_p->ue_context.Initialue_identity_s_TMSI.mme_code = mme_code;
@@ -2062,7 +2102,7 @@ rrc_eNB_decode_ccch_NB(
        }
      }
-//XXX MP: RRM not used
+//MP: RRM not used
 //#ifndef NO_RRM
 //      send_msg(&S_rrc, msg_rrc_MR_attach_ind(ctxt_pP->module_id, Mac_id));
 //#else
@@ -2076,9 +2116,9 @@ rrc_eNB_decode_ccch_NB(
      //generate RRCConnectionSetup-NB
      rrc_eNB_generate_RRCConnectionSetup_NB(ctxt_pP, ue_context_p, CC_id);
-      LOG_I(RRC, PROTOCOL_RRC_CTXT_UE_FMT"CALLING RLC CONFIG SRB1 (rbid %d)\n",
+      LOG_I(RRC, PROTOCOL_RRC_CTXT_UE_FMT"CALLING RLC CONFIG SRB1bis and SRB1 (rbid %d, rbid %d)\n",
            PROTOCOL_RRC_CTXT_UE_ARGS(ctxt_pP),
-            Idx);
+            DCCH0, DCCH1);
      MSC_LOG_TX_MESSAGE(
        MSC_RRC_ENB,
@@ -2089,7 +2129,7 @@ rrc_eNB_decode_ccch_NB(
        MSC_AS_TIME_ARGS(ctxt_pP),
        ue_context_p->ue_context.rnti);
-      //XXX we should not configure PDCP for SRB1bis but only for SRB1
+      //MP: we should not configure PDCP for SRB1bis but only for SRB1
      NB_rrc_pdcp_config_asn1_req(ctxt_pP,
                               ue_context_p->ue_context.SRB_configList, //contain SRB1bis but used as SRB1
                               (DRB_ToAddModList_NB_r13_t *) NULL,
@@ -2148,7 +2188,7 @@ rrc_eNB_decode_ccch_NB(
                (rrcConnectionResumeRequest_NB->resumeCause_r13 == EstablishmentCause_NB_r13_mo_ExceptionData) ? "mo Exception data" :
                "delay tollerant Access v1330"));
-    //only reject for now
+    //MP: only reject for now
    rrc_eNB_generate_RRCConnectionReject_NB(ctxt_pP,
                                 rrc_eNB_get_ue_context_NB(&eNB_rrc_inst_NB[ctxt_pP->module_id], ctxt_pP->rnti),
                                 CC_id);
@@ -2193,7 +2233,6 @@ rrc_eNB_decode_dcch_NB(
  T(T_ENB_RRC_UL_DCCH_DATA_IN, T_INT(ctxt_pP->module_id), T_INT(ctxt_pP->frame),
    T_INT(ctxt_pP->subframe), T_INT(ctxt_pP->rnti));
-  //FIXME : depends on how SRBs are managed
  if ((Srb_id != 1) && (Srb_id != 3)) {
    LOG_E(RRC, PROTOCOL_RRC_CTXT_UE_FMT" Received message on SRB%d, should not have ...\n",
          PROTOCOL_RRC_CTXT_UE_ARGS(ctxt_pP),
@@ -2215,36 +2254,8 @@ rrc_eNB_decode_dcch_NB(
               0,
               0);
-  //TODO:delete?
+//#if defined(ENABLE_ITTI)
-#if defined(ENABLE_ITTI)
+//#   if defined(DISABLE_ITTI_XER_PRINT)
-#   if defined(DISABLE_ITTI_XER_PRINT)
-  {
-    MessageDef                         *message_p;
-    message_p = itti_alloc_new_message(TASK_RRC_ENB, RRC_UL_DCCH_MESSAGE);
-    memcpy(&message_p->ittiMsg, (void *)ul_dcch_msg, sizeof(RrcUlDcchMessage));
-    itti_send_msg_to_task(TASK_UNKNOWN, ctxt_pP->instance, message_p);
-  }
-#   else
-  {
-    char                                message_string[10000];
-    size_t                              message_string_size;
-    if ((message_string_size =
-           xer_sprint(message_string, sizeof(message_string), &asn_DEF_UL_DCCH_Message_NB, (void *)ul_dcch_msg_NB)) >= 0) {
-      MessageDef                         *msg_p;
-      msg_p = itti_alloc_new_message_sized(TASK_RRC_ENB, RRC_UL_DCCH, message_string_size + sizeof(IttiMsgText));
-      msg_p->ittiMsg.rrc_ul_dcch.size = message_string_size;
-      memcpy(&msg_p->ittiMsg.rrc_ul_dcch.text, message_string, message_string_size);
-      itti_send_msg_to_task(TASK_UNKNOWN, ctxt_pP->instance, msg_p);
-    }
-  }
-#   endif
-#endif
  {
    for (i = 0; i < sdu_sizeP; i++) {
@@ -2304,7 +2315,8 @@ rrc_eNB_decode_dcch_NB(
      if (ul_dcch_msg_NB->message.choice.c1.choice.rrcConnectionReconfigurationComplete_r13.criticalExtensions.
          present == RRCConnectionReconfigurationComplete_NB__criticalExtensions_PR_rrcConnectionReconfigurationComplete_r13) {
 	/*NN: revise the condition */
-    	  //XXX MP: RRC_RECONFIGURED indicate if the default/dedicated bearer has been/has been not established
+   //MP: RRC_RECONFIGURED indicate if the default/dedicated bearer has been/not established
        if (ue_context_p->ue_context.Status == RRC_RECONFIGURED){ // a dedicated bearers has been established
 	  dedicated_DRB = 1;
 	  LOG_I(RRC,
@@ -2344,7 +2356,8 @@ rrc_eNB_decode_dcch_NB(
 						       ue_context_p);
 	}
      }
-#else  // MP: ENABLE_USE_MME ??
+#else  // MP: not use of MME
+      //dedicated bearer in the absence of EPC
      if (dedicated_DRB == 0 ) {
 	rrc_eNB_reconfigure_DRBs_NB(ctxt_pP,ue_context_p); //MP: establish a dedicated DRB
      }
@@ -2387,7 +2400,7 @@ rrc_eNB_decode_dcch_NB(
      break;
    case UL_DCCH_MessageType_NB__c1_PR_rrcConnectionSetupComplete_r13:
-    	//XXX MP: Ts 36.331 V14.2.1 RRCConnectionSetupComplete is transmitted over SRB1bis (pag 585)
+    	//MP: Ts 36.331 V14.2.1 RRCConnectionSetupComplete is transmitted over SRB1bis (pag 585)
 #ifdef RRC_MSG_PRINT
      LOG_F(RRC,"[MSG] RRCConnectionSetupComplete-NB\n");
@@ -2449,7 +2462,6 @@ rrc_eNB_decode_dcch_NB(
    	/* R2-163262 3GPP NB-IOT Ad-hoc Meeting #2
    	 * After receiving the SMC and performing the security activation, the UE shall use the SRB1.
-    	 * If the UE fails the security activation, the UE shall use the SRB1-bis for Security Mode Complete message failure
    	 */
      T(T_ENB_RRC_SECURITY_MODE_COMPLETE, T_INT(ctxt_pP->module_id), T_INT(ctxt_pP->frame),
@@ -2489,11 +2501,9 @@ rrc_eNB_decode_dcch_NB(
      xer_fprint(stdout, &asn_DEF_UL_DCCH_Message_NB, (void *)ul_dcch_msg_NB);
 #endif
-      // confirm with PDCP about the security mode for DCCH
-      //rrc_pdcp_config_req (enb_mod_idP, frameP, 1,CONFIG_ACTION_SET_SECURITY_MODE, (ue_mod_idP * NB_RB_MAX) + DCCH, 0x77);
-      // continue the procedure
-      //MP: this is OPTIONAL operation
+      //MP: this is OPTIONAL
      ue_context_p->ue_context.Srb1bis.Active=0;
@@ -2553,17 +2563,16 @@ rrc_eNB_decode_dcch_NB(
 #endif
-//XXX MP: According with prof.Navid, after reception of SecurityModeFailure we should configure no security
+//MP: After reception of SecurityModeFailure we should configure no security
-      	 //therefore setting securityActivated=0 for the corresponding PDCP entity in the PDCP but still start the usage of SRB1
+//therefore setting securityActivated=0 for the corresponding PDCP entity in the PDCP but still start the usage of SRB1
-//MP: problem1: rrc_pdcp_config_req function is no more used and have no definition for CONFIG_ACTION_REMOVE (old implementation)
      //   pdcp_pP-> security_activated modified (=1) by pdcp_config_set_security in NB_pdcp_config_req_asn1 at configuration time
      //   we now create a particular case for pdcp_config_set_securityy function in which for a particular securityMode (= -1) we deactivate security.
      //   we first invoke the NB_rrc_pdcp_config_asn1_req that with the particular case of securityMode = -1 will disable security through the pdcp_config_set_security
-//XXX MP: the integrity protection is still not used in OAI --> MAC-I is padded always to 0 so no need to modify it
+//MP: the integrity protection is still not used in OAI --> MAC-I is padded always to 0 so no need to modify it
      NB_rrc_pdcp_config_asn1_req(
    		  	  	  	  	  	  ctxt_pP,
@@ -2584,7 +2593,7 @@ rrc_eNB_decode_dcch_NB(
    case UL_DCCH_MessageType_NB__c1_PR_ueCapabilityInformation_r13:
-    	//XXX message received over SRB1
+    	//MP: received over SRB1
      T(T_ENB_RRC_UE_CAPABILITY_INFORMATION, T_INT(ctxt_pP->module_id), T_INT(ctxt_pP->frame),
        T_INT(ctxt_pP->subframe), T_INT(ctxt_pP->rnti));
@@ -2647,7 +2656,7 @@ rrc_eNB_decode_dcch_NB(
      for (i = 0; i < ue_context_p->ue_context.nb_of_e_rabs; i++){
 	ue_context_p->ue_context.e_rab[i].status = E_RAB_NB_STATUS_NEW;
 	ue_context_p->ue_context.e_rab[i].param.e_rab_id = 1+i;
-	ue_context_p->ue_context.e_rab[i].param.qos.qci=9; //Non-GBR the default value (TS
+	ue_context_p->ue_context.e_rab[i].param.qos.qci=9; //Non-GBR
      }
      ue_context_p->ue_context.setup_e_rabs =ue_context_p->ue_context.nb_of_e_rabs;
 #endif
@@ -2840,7 +2849,7 @@ rrc_enb_task_NB(
      /* Messages from S1AP */
    case S1AP_DOWNLINK_NAS:
-      rrc_eNB_process_S1AP_DOWNLINK_NAS(msg_p, msg_name_p, instance, &rrc_eNB_mui);
+      rrc_eNB_process_S1AP_DOWNLINK_NAS(msg_p, msg_name_p, instance, &rrc_eNB_mui_NB);
      break;
    case S1AP_INITIAL_CONTEXT_SETUP_REQ:

--- a/openair2/RRC/LITE/vars_nb_iot.c
+++ b/openair2/RRC/LITE/vars_nb_iot.c
@@ -99,12 +99,12 @@ LCHAN_DESC BCCH_LCHAN_DESC,CCCH_LCHAN_DESC,DCCH_LCHAN_DESC,DTCH_DL_LCHAN_DESC,DT
 //MAC_AVG_T BCCH_MEAS_AVG, CCCH_MEAS_AVG,DCCH_MEAS_AVG, DTCH_MEAS_AVG;
 // timers (TS 36.331 "UE-TimersAndConstants-NB" pag 622) (milliseconds) XXX MP:--> not sure they will be used
-uint16_t T300[8] = {2500,4000,6000,10000, 15000,25000,40000,60000};
+uint16_t T300_NB[8] = {2500,4000,6000,10000, 15000,25000,40000,60000};
-uint16_t T301[8] = {2500,4000,6000,10000, 15000,25000,40000,60000}; //MP: this start at RRCconnectionReestablishmentReq (not implemented in OAI)
+uint16_t T301_NB[8] = {2500,4000,6000,10000, 15000,25000,40000,60000}; //MP: this start at RRCconnectionReestablishmentReq (not implemented in OAI)
-uint16_t T310[8] = {0,200,500,1000,2000,4000,8000};
+uint16_t T310_NB[8] = {0,200,500,1000,2000,4000,8000};
-uint16_t T311[8] = {1000, 3000, 5000, 10000, 15000, 20000, 30000}; //MP: may not used
+uint16_t T311_NB[8] = {1000, 3000, 5000, 10000, 15000, 20000, 30000}; //MP: may not used
-uint16_t N310[8] = {1,2,3,4,6,8,10,20};
+uint16_t N310_NB[8] = {1,2,3,4,6,8,10,20};
-uint16_t N311[8] = {1,2,3,4,5,6,8,10};
+uint16_t N311_NB[8] = {1,2,3,4,5,6,8,10};
 // MP: TimeToTrigger not used in NB-IoT