diff --git a/openbsc/include/openbsc/gprs_sgsn.h b/openbsc/include/openbsc/gprs_sgsn.h
index 5fbbf28..0e574d8 100644
--- a/openbsc/include/openbsc/gprs_sgsn.h
+++ b/openbsc/include/openbsc/gprs_sgsn.h
@@ -92,10 +92,28 @@
 	uint8_t ti;
 };
 
+enum sgsn_ran_type {
+	/* GPRS/EDGE via Gb */
+	MM_CTX_T_GERAN_Gb,
+	/* UMTS via Iu */
+	MM_CTX_T_UTRAN_Iu,
+	/* GPRS/EDGE via Iu */
+	MM_CTX_T_GERAN_Iu,
+};
+
+struct service_info {
+	uint8_t type;
+	uint16_t pdp_status;
+};
+
+struct ue_conn_ctx;
+
 /* According to TS 03.60, Table 5: SGSN MM and PDP Contexts */
 /* Extended by 3GPP TS 23.060, Table 6: SGSN MM and PDP Contexts */
 struct sgsn_mm_ctx {
 	struct llist_head	list;
+
+	enum sgsn_ran_type	ran_type;
 
 	char 			imsi[GSM23003_IMSI_MAX_DIGITS+1];
 	enum gprs_gmm_state	mm_state;
@@ -106,10 +124,32 @@
 	/* Opt: Software Version Numbber / TS 23.195 */
 	char 			msisdn[GSM_EXTENSION_LENGTH];
 	struct gprs_ra_id	ra;
-	uint16_t		cell_id;
-	uint32_t		cell_id_age;
-	uint16_t		sac;	/* Iu: Service Area Code */
-	uint32_t		sac_age;/* Iu: Service Area Code age */
+	struct {
+		uint16_t		cell_id;	/* Gb only */
+		uint32_t		cell_id_age;	/* Gb only */
+		uint8_t			radio_prio_sms;
+
+		/* Additional bits not present in the GSM TS */
+		uint16_t		nsei;
+		uint16_t		bvci;
+		struct gprs_llc_llme	*llme;
+		uint32_t		tlli;
+		uint32_t		tlli_new;
+	} gb;
+	struct {
+		int			new_key;
+		uint16_t		sac;		/* Iu: Service Area Code */
+		uint32_t		sac_age;	/* Iu: Service Area Code age */
+		/* CSG ID */
+		/* CSG Membership */
+		/* Access Mode */
+		/* Seelected CN Operator ID (TS 23.251) */
+		/* CSG Subscription Data */
+		/* LIPA Allowed */
+		/* Voice Support Match Indicator */
+		struct ue_conn_ctx	*ue_ctx;
+		struct service_info	service;
+	} iu;
 	/* VLR number */
 	uint32_t		new_sgsn_addr;
 	/* Authentication Triplet */
@@ -118,30 +158,38 @@
 	/* Iu: CK, IK, KSI */
 	/* CKSN */
 	enum gprs_ciph_algo	ciph_algo;
+
 	struct {
 		uint8_t	len;
 		uint8_t	buf[50];	/* GSM 04.08 10.5.5.12a, extended in TS 24.008 */
 	} ms_radio_access_capa;
+	/* Supported Codecs (SRVCC) */
 	struct {
 		uint8_t	len;
 		uint8_t	buf[8];		/* GSM 04.08 10.5.5.12, extended in TS 24.008 */
 	} ms_network_capa;
+	/* UE Netowrk Capability (E-UTRAN) */
 	uint16_t		drx_parms;
+	/* Active Time value for PSM */
 	int			mnrg;	/* MS reported to HLR? */
 	int			ngaf;	/* MS reported to MSC/VLR? */
 	int			ppf;	/* paging for GPRS + non-GPRS? */
+	/* Subscribed Charging Characteristics */
+	/* Trace Reference */
+	/* Trace Type */
+	/* Trigger ID */
+	/* OMC Identity */
 	/* SMS Parameters */
 	int			recovery;
-	uint8_t			radio_prio_sms;
+	/* Access Restriction */
+	/* GPRS CSI (CAMEL) */
+	/* MG-CSI (CAMEL) */
+	/* Subscribed UE-AMBR */
+	/* UE-AMBR */
+	/* APN Subscribed */
 
 	struct llist_head	pdp_list;
 
-	/* Additional bits not present in the GSM TS */
-	struct gprs_llc_llme	*llme;
-	uint32_t		tlli;
-	uint32_t		tlli_new;
-	uint16_t		nsei;
-	uint16_t		bvci;
 	struct rate_ctr_group	*ctrg;
 	struct osmo_timer_list	timer;
 	unsigned int		T;		/* Txxxx number */
diff --git a/openbsc/src/gprs/gprs_gmm.c b/openbsc/src/gprs/gprs_gmm.c
index 2bbc5ff..889ac98 100644
--- a/openbsc/src/gprs/gprs_gmm.c
+++ b/openbsc/src/gprs/gprs_gmm.c
@@ -151,16 +151,16 @@
 /* Store BVCI/NSEI in MM context */
 static void msgid2mmctx(struct sgsn_mm_ctx *mm, const struct msgb *msg)
 {
-	mm->bvci = msgb_bvci(msg);
-	mm->nsei = msgb_nsei(msg);
+	mm->gb.bvci = msgb_bvci(msg);
+	mm->gb.nsei = msgb_nsei(msg);
 }
 
 /* Store BVCI/NSEI in MM context */
 static void mmctx2msgid(struct msgb *msg, const struct sgsn_mm_ctx *mm)
 {
-	msgb_tlli(msg) = mm->tlli;
-	msgb_bvci(msg) = mm->bvci;
-	msgb_nsei(msg) = mm->nsei;
+	msgb_tlli(msg) = mm->gb.tlli;
+	msgb_bvci(msg) = mm->gb.bvci;
+	msgb_nsei(msg) = mm->gb.nsei;
 }
 
 static void mm_ctx_cleanup_free(struct sgsn_mm_ctx *ctx, const char *log_text)
@@ -904,8 +904,8 @@
 			strncpy(ctx->imsi, mi_string, sizeof(ctx->imsi) - 1);
 #endif
 		}
-		ctx->tlli = msgb_tlli(msg);
-		ctx->llme = llme;
+		ctx->gb.tlli = msgb_tlli(msg);
+		ctx->gb.llme = llme;
 		msgid2mmctx(ctx, msg);
 		break;
 	case GSM_MI_TYPE_TMSI:
@@ -920,8 +920,8 @@
 			ctx = sgsn_mm_ctx_alloc(msgb_tlli(msg), &ra_id);
 			ctx->p_tmsi = tmsi;
 		}
-		ctx->tlli = msgb_tlli(msg);
-		ctx->llme = llme;
+		ctx->gb.tlli = msgb_tlli(msg);
+		ctx->gb.llme = llme;
 		msgid2mmctx(ctx, msg);
 		break;
 	default:
@@ -932,7 +932,7 @@
 	}
 	/* Update MM Context with currient RA and Cell ID */
 	ctx->ra = ra_id;
-	ctx->cell_id = cid;
+	ctx->gb.cell_id = cid;
 	/* Update MM Context with other data */
 	ctx->drx_parms = drx_par;
 	ctx->ms_radio_access_capa.len = ms_ra_acc_cap_len;
@@ -952,10 +952,10 @@
 #endif
 	/* Even if there is no P-TMSI allocated, the MS will switch from
 	 * foreign TLLI to local TLLI */
-	ctx->tlli_new = gprs_tmsi2tlli(ctx->p_tmsi, TLLI_LOCAL);
+	ctx->gb.tlli_new = gprs_tmsi2tlli(ctx->p_tmsi, TLLI_LOCAL);
 
 	/* Inform LLC layer about new TLLI but keep old active */
-	gprs_llgmm_assign(ctx->llme, ctx->tlli, ctx->tlli_new,
+	gprs_llgmm_assign(ctx->gb.llme, ctx->gb.tlli, ctx->gb.tlli_new,
 			  GPRS_ALGO_GEA0, NULL);
 
 	ctx->pending_req = GSM48_MT_GMM_ATTACH_REQ;
@@ -1182,7 +1182,7 @@
 				"TLLI: %08x (%08x), RA: %d-%d-%d-%d\n",
 				msgb_tlli(msg),
 				mmctx->p_tmsi, mmctx->p_tmsi_old,
-				mmctx->tlli, mmctx->tlli_new,
+				mmctx->gb.tlli, mmctx->gb.tlli_new,
 				mmctx->ra.mcc, mmctx->ra.mnc,
 				mmctx->ra.lac, mmctx->ra.rac);
 
@@ -1219,7 +1219,7 @@
 	/* Update the MM context with the new RA-ID */
 	bssgp_parse_cell_id(&mmctx->ra, msgb_bcid(msg));
 	/* Update the MM context with the new (i.e. foreign) TLLI */
-	mmctx->tlli = msgb_tlli(msg);
+	mmctx->gb.tlli = msgb_tlli(msg);
 	/* FIXME: Update the MM context with the MS radio acc capabilities */
 	/* FIXME: Update the MM context with the MS network capabilities */
 
@@ -1246,10 +1246,10 @@
 #endif
 	/* Even if there is no P-TMSI allocated, the MS will switch from
 	 * foreign TLLI to local TLLI */
-	mmctx->tlli_new = gprs_tmsi2tlli(mmctx->p_tmsi, TLLI_LOCAL);
+	mmctx->gb.tlli_new = gprs_tmsi2tlli(mmctx->p_tmsi, TLLI_LOCAL);
 
 	/* Inform LLC layer about new TLLI but keep old active */
-	gprs_llgmm_assign(mmctx->llme, mmctx->tlli, mmctx->tlli_new,
+	gprs_llgmm_assign(mmctx->gb.llme, mmctx->gb.tlli, mmctx->gb.tlli_new,
 			  GPRS_ALGO_GEA0, NULL);
 
 	/* Look at PDP Context Status IE and see if MS's view of
@@ -1369,8 +1369,8 @@
 		mmctx->p_tmsi_old = 0;
 		mmctx->pending_req = 0;
 		/* Unassign the old TLLI */
-		mmctx->tlli = mmctx->tlli_new;
-		gprs_llgmm_assign(mmctx->llme, 0xffffffff, mmctx->tlli_new,
+		mmctx->gb.tlli = mmctx->gb.tlli_new;
+		gprs_llgmm_assign(mmctx->gb.llme, 0xffffffff, mmctx->gb.tlli_new,
 				  GPRS_ALGO_GEA0, NULL);
 		mmctx->mm_state = GMM_REGISTERED_NORMAL;
 		rc = 0;
@@ -1387,8 +1387,8 @@
 		mmctx->p_tmsi_old = 0;
 		mmctx->pending_req = 0;
 		/* Unassign the old TLLI */
-		mmctx->tlli = mmctx->tlli_new;
-		gprs_llgmm_assign(mmctx->llme, 0xffffffff, mmctx->tlli_new,
+		mmctx->gb.tlli = mmctx->gb.tlli_new;
+		gprs_llgmm_assign(mmctx->gb.llme, 0xffffffff, mmctx->gb.tlli_new,
 				  GPRS_ALGO_GEA0, NULL);
 		mmctx->mm_state = GMM_REGISTERED_NORMAL;
 		rc = 0;
@@ -1404,8 +1404,8 @@
 		mmctx->p_tmsi_old = 0;
 		mmctx->pending_req = 0;
 		/* Unassign the old TLLI */
-		mmctx->tlli = mmctx->tlli_new;
-		//gprs_llgmm_assign(mmctx->llme, 0xffffffff, mmctx->tlli_new, GPRS_ALGO_GEA0, NULL);
+		mmctx->gb.tlli = mmctx->gb.tlli_new;
+		//gprs_llgmm_assign(mmctx->gb.llme, 0xffffffff, mmctx->gb.tlli_new, GPRS_ALGO_GEA0, NULL);
 		rc = 0;
 		break;
 	case GSM48_MT_GMM_AUTH_CIPH_RESP:
@@ -2077,7 +2077,7 @@
 int gsm0408_gprs_force_reattach(struct sgsn_mm_ctx *mmctx)
 {
 	int rc;
-	gprs_llgmm_reset(mmctx->llme);
+	gprs_llgmm_reset(mmctx->gb.llme);
 
 	rc = gsm48_tx_gmm_detach_req(
 		mmctx, GPRS_DET_T_MT_REATT_REQ, GMM_CAUSE_IMPL_DETACHED);
@@ -2101,7 +2101,7 @@
 	if (mmctx) {
 		msgid2mmctx(mmctx, msg);
 		rate_ctr_inc(&mmctx->ctrg->ctr[GMM_CTR_PKTS_SIG_IN]);
-		mmctx->llme = llme;
+		mmctx->gb.llme = llme;
 	}
 
 	/* MMCTX can be NULL */
diff --git a/openbsc/src/gprs/gprs_llc.c b/openbsc/src/gprs/gprs_llc.c
index 4cf5163..3a45f62 100644
--- a/openbsc/src/gprs/gprs_llc.c
+++ b/openbsc/src/gprs/gprs_llc.c
@@ -56,8 +56,8 @@
 		dup.ms_ra_cap.v = mmctx->ms_radio_access_capa.buf;
 
 		/* make sure we only send it to the right llme */
-		OSMO_ASSERT(msgb_tlli(msg) == mmctx->llme->tlli
-				|| msgb_tlli(msg) == mmctx->llme->old_tlli);
+		OSMO_ASSERT(msgb_tlli(msg) == mmctx->gb.llme->tlli
+				|| msgb_tlli(msg) == mmctx->gb.llme->old_tlli);
 	}
 	memcpy(&dup.qos_profile, qos_profile_default,
 		sizeof(qos_profile_default));
diff --git a/openbsc/src/gprs/gprs_sgsn.c b/openbsc/src/gprs/gprs_sgsn.c
index 65f789d..8bb6850 100644
--- a/openbsc/src/gprs/gprs_sgsn.c
+++ b/openbsc/src/gprs/gprs_sgsn.c
@@ -97,7 +97,7 @@
 	struct sgsn_mm_ctx *ctx;
 
 	llist_for_each_entry(ctx, &sgsn_mm_ctxts, list) {
-		if ((tlli == ctx->tlli || tlli == ctx->tlli_new) &&
+		if ((tlli == ctx->gb.tlli || tlli == ctx->gb.tlli_new) &&
 		    gprs_ra_id_equals(raid, &ctx->ra))
 			return ctx;
 	}
@@ -165,7 +165,8 @@
 		return NULL;
 
 	memcpy(&ctx->ra, raid, sizeof(ctx->ra));
-	ctx->tlli = tlli;
+	ctx->ran_type = MM_CTX_T_GERAN_Gb;
+	ctx->gb.tlli = tlli;
 	ctx->mm_state = GMM_DEREGISTERED;
 	ctx->auth_triplet.key_seq = GSM_KEY_SEQ_INVAL;
 	ctx->ctrg = rate_ctr_group_alloc(ctx, &mmctx_ctrg_desc, tlli);
@@ -196,8 +197,8 @@
 
 void sgsn_mm_ctx_cleanup_free(struct sgsn_mm_ctx *mm)
 {
-	struct gprs_llc_llme *llme = mm->llme;
-	uint32_t tlli = mm->tlli;
+	struct gprs_llc_llme *llme = mm->gb.llme;
+	uint32_t tlli = mm->gb.tlli;
 	struct sgsn_pdp_ctx *pdp, *pdp2;
 	struct sgsn_signal_data sig_data;
 
@@ -308,7 +309,7 @@
 	LOGPDPCTXP(LOGL_INFO, pdp, "Forcing release of PDP context\n");
 
 	/* Force the deactivation of the SNDCP layer */
-	sndcp_sm_deactivate_ind(&pdp->mm->llme->lle[pdp->sapi], pdp->nsapi);
+	sndcp_sm_deactivate_ind(&pdp->mm->gb.llme->lle[pdp->sapi], pdp->nsapi);
 
 	memset(&sig_data, 0, sizeof(sig_data));
 	sig_data.pdp = pdp;
@@ -751,7 +752,7 @@
 	struct sgsn_mm_ctx *mmctx = NULL;
 
 	llist_for_each_entry(mmctx, &sgsn_mm_ctxts, list) {
-		if (llme == mmctx->llme) {
+		if (llme == mmctx->gb.llme) {
 			gsm0408_gprs_access_cancelled(mmctx, SGSN_ERROR_CAUSE_NONE);
 			return;
 		}
diff --git a/openbsc/src/gprs/sgsn_cdr.c b/openbsc/src/gprs/sgsn_cdr.c
index d0cb712..bf0d6f7 100644
--- a/openbsc/src/gprs/sgsn_cdr.c
+++ b/openbsc/src/gprs/sgsn_cdr.c
@@ -94,7 +94,7 @@
 		mmctx->imsi,
 		mmctx->imei,
 		mmctx->msisdn,
-		mmctx->cell_id,
+		mmctx->gb.cell_id,
 		mmctx->ra.lac,
 		mmctx->hlr,
 		ev);
@@ -179,7 +179,7 @@
 		pdp->mm ? pdp->mm->imsi : "N/A",
 		pdp->mm ? pdp->mm->imei : "N/A",
 		pdp->mm ? pdp->mm->msisdn : "N/A",
-		pdp->mm ? pdp->mm->cell_id : -1,
+		pdp->mm ? pdp->mm->gb.cell_id : -1,
 		pdp->mm ? pdp->mm->ra.lac : -1,
 		pdp->mm ? pdp->mm->hlr : "N/A",
 		ev,
diff --git a/openbsc/src/gprs/sgsn_libgtp.c b/openbsc/src/gprs/sgsn_libgtp.c
index aaf7e7a..f7a4ca0 100644
--- a/openbsc/src/gprs/sgsn_libgtp.c
+++ b/openbsc/src/gprs/sgsn_libgtp.c
@@ -239,7 +239,7 @@
 	pdp->userloc_given = 1;
 	pdp->userloc.l = 8;
 	pdp->userloc.v[0] = 0; /* CGI for GERAN */
-	bssgp_create_cell_id(&pdp->userloc.v[1], &mmctx->ra, mmctx->cell_id);
+	bssgp_create_cell_id(&pdp->userloc.v[1], &mmctx->ra, mmctx->gb.cell_id);
 
 	/* include the IMEI(SV) */
 	pdp->imeisv_given = 1;
@@ -341,7 +341,7 @@
 	}
 
 	/* Activate the SNDCP layer */
-	sndcp_sm_activate_ind(&pctx->mm->llme->lle[pctx->sapi], pctx->nsapi);
+	sndcp_sm_activate_ind(&pctx->mm->gb.llme->lle[pctx->sapi], pctx->nsapi);
 
 	/* Inform others about it */
 	memset(&sig_data, 0, sizeof(sig_data));
@@ -388,7 +388,7 @@
 
 	if (pctx->mm) {
 		/* Deactivate the SNDCP layer */
-		sndcp_sm_deactivate_ind(&pctx->mm->llme->lle[pctx->sapi], pctx->nsapi);
+		sndcp_sm_deactivate_ind(&pctx->mm->gb.llme->lle[pctx->sapi], pctx->nsapi);
 
 		/* Confirm deactivation of PDP context to MS */
 		rc = gsm48_tx_gsm_deact_pdp_acc(pctx);
@@ -521,9 +521,9 @@
 	ud = msgb_put(msg, len);
 	memcpy(ud, packet, len);
 
-	msgb_tlli(msg) = mm->tlli;
-	msgb_bvci(msg) = mm->bvci;
-	msgb_nsei(msg) = mm->nsei;
+	msgb_tlli(msg) = mm->gb.tlli;
+	msgb_bvci(msg) = mm->gb.bvci;
+	msgb_nsei(msg) = mm->gb.nsei;
 
 	switch (mm->mm_state) {
 	case GMM_REGISTERED_SUSPENDED:
@@ -531,12 +531,12 @@
 		memset(&pinfo, 0, sizeof(pinfo));
 		pinfo.mode = BSSGP_PAGING_PS;
 		pinfo.scope = BSSGP_PAGING_BVCI;
-		pinfo.bvci = mm->bvci;
+		pinfo.bvci = mm->gb.bvci;
 		pinfo.imsi = mm->imsi;
 		pinfo.ptmsi = &mm->p_tmsi;
 		pinfo.drx_params = mm->drx_parms;
 		pinfo.qos[0] = 0; // FIXME
-		bssgp_tx_paging(mm->nsei, 0, &pinfo);
+		bssgp_tx_paging(mm->gb.nsei, 0, &pinfo);
 		rate_ctr_inc(&mm->ctrg->ctr[GMM_CTR_PAGING_PS]);
 		/* FIXME: queue the packet we received from GTP */
 		break;
@@ -544,7 +544,7 @@
 		break;
 	default:
 		LOGP(DGPRS, LOGL_ERROR, "GTP DATA IND for TLLI %08X in state "
-			"%u\n", mm->tlli, mm->mm_state);
+			"%u\n", mm->gb.tlli, mm->mm_state);
 		msgb_free(msg);
 		return -1;
 	}
@@ -557,7 +557,7 @@
 	/* It is easier to have a global count */
 	pdp->cdr_bytes_out += len;
 
-	return sndcp_unitdata_req(msg, &mm->llme->lle[pdp->sapi],
+	return sndcp_unitdata_req(msg, &mm->gb.llme->lle[pdp->sapi],
 				  pdp->nsapi, mm);
 }
 
diff --git a/openbsc/src/gprs/sgsn_vty.c b/openbsc/src/gprs/sgsn_vty.c
index f16c95a..02c0f31 100644
--- a/openbsc/src/gprs/sgsn_vty.c
+++ b/openbsc/src/gprs/sgsn_vty.c
@@ -431,12 +431,12 @@
 	vty_out(vty, "%sMM Context for IMSI %s, IMEI %s, P-TMSI %08x%s",
 		pfx, mm->imsi, mm->imei, mm->p_tmsi, VTY_NEWLINE);
 	vty_out(vty, "%s  MSISDN: %s, TLLI: %08x%s HLR: %s",
-		pfx, mm->msisdn, mm->tlli, mm->hlr, VTY_NEWLINE);
+		pfx, mm->msisdn, mm->gb.tlli, mm->hlr, VTY_NEWLINE);
 	vty_out(vty, "%s  MM State: %s, Routeing Area: %u-%u-%u-%u, "
 		"Cell ID: %u%s", pfx,
 		get_value_string(gprs_mm_st_strs, mm->mm_state),
 		mm->ra.mcc, mm->ra.mnc, mm->ra.lac, mm->ra.rac,
-		mm->cell_id, VTY_NEWLINE);
+		mm->gb.cell_id, VTY_NEWLINE);
 
 	vty_out_rate_ctr_group(vty, " ", mm->ctrg);
 
diff --git a/openbsc/tests/sgsn/sgsn_test.c b/openbsc/tests/sgsn/sgsn_test.c
index afff30f..3fb359b 100644
--- a/openbsc/tests/sgsn/sgsn_test.c
+++ b/openbsc/tests/sgsn/sgsn_test.c
@@ -174,7 +174,7 @@
 	lle = gprs_lle_get_or_create(tlli, 3);
 	ctx = sgsn_mm_ctx_alloc(tlli, raid);
 	ctx->mm_state = GMM_REGISTERED_NORMAL;
-	ctx->llme = lle->llme;
+	ctx->gb.llme = lle->llme;
 
 	ictx = sgsn_mm_ctx_by_tlli(tlli, raid);
 	OSMO_ASSERT(ictx == ctx);
@@ -729,7 +729,7 @@
 	ctx = alloc_mm_ctx(local_tlli, &raid);
 
 	/* inject the detach */
-	send_0408_message(ctx->llme, local_tlli, &raid,
+	send_0408_message(ctx->gb.llme, local_tlli, &raid,
 			  detach_req, ARRAY_SIZE(detach_req));
 
 	/* verify that a single message (hopefully the Detach Accept) has been
@@ -770,7 +770,7 @@
 	ctx = alloc_mm_ctx(local_tlli, &raid);
 
 	/* inject the detach */
-	send_0408_message(ctx->llme, local_tlli, &raid,
+	send_0408_message(ctx->gb.llme, local_tlli, &raid,
 			  detach_req, ARRAY_SIZE(detach_req));
 
 	/* verify that no message (and therefore no Detach Accept) has been
@@ -967,14 +967,14 @@
 	OSMO_ASSERT(sgsn_tx_counter == 1);
 
 	/* inject the identity response (IMEI) */
-	send_0408_message(ctx->llme, foreign_tlli, &raid,
+	send_0408_message(ctx->gb.llme, foreign_tlli, &raid,
 			  ident_resp_imei, ARRAY_SIZE(ident_resp_imei));
 
 	/* we expect an identity request (IMSI) */
 	OSMO_ASSERT(sgsn_tx_counter == 1);
 
 	/* inject the identity response (IMSI) */
-	send_0408_message(ctx->llme, foreign_tlli, &raid,
+	send_0408_message(ctx->gb.llme, foreign_tlli, &raid,
 			  ident_resp_imsi, ARRAY_SIZE(ident_resp_imsi));
 
 	/* check that the MM context has not been removed due to a failed
@@ -996,7 +996,7 @@
 		/* we got an auth & ciph request */
 
 		/* inject the auth & ciph response */
-		send_0408_message(ctx->llme, foreign_tlli, &raid,
+		send_0408_message(ctx->gb.llme, foreign_tlli, &raid,
 				  auth_ciph_resp, ARRAY_SIZE(auth_ciph_resp));
 
 		/* check that the MM context has not been removed due to a
@@ -1018,7 +1018,7 @@
 	local_tlli = gprs_tmsi2tlli(ptmsi1, TLLI_LOCAL);
 
 	/* inject the attach complete */
-	send_0408_message(ctx->llme, local_tlli, &raid,
+	send_0408_message(ctx->gb.llme, local_tlli, &raid,
 			  attach_compl, ARRAY_SIZE(attach_compl));
 
 	OSMO_ASSERT(ctx->mm_state == GMM_REGISTERED_NORMAL);
@@ -1027,7 +1027,7 @@
 	OSMO_ASSERT(sgsn_tx_counter == 0);
 
 	/* inject the detach */
-	send_0408_message(ctx->llme, local_tlli, &raid,
+	send_0408_message(ctx->gb.llme, local_tlli, &raid,
 			  detach_req, ARRAY_SIZE(detach_req));
 
 	/* verify that things are gone */
@@ -1555,14 +1555,14 @@
 	OSMO_ASSERT(sgsn_tx_counter == 1);
 
 	/* inject the identity response (IMEI) */
-	send_0408_message(ctx->llme, foreign_tlli, &raid,
+	send_0408_message(ctx->gb.llme, foreign_tlli, &raid,
 			  ident_resp_imei, ARRAY_SIZE(ident_resp_imei));
 
 	/* we expect an identity request (IMSI) */
 	OSMO_ASSERT(sgsn_tx_counter == 1);
 
 	/* inject the identity response (IMSI) */
-	send_0408_message(ctx->llme, foreign_tlli, &raid,
+	send_0408_message(ctx->gb.llme, foreign_tlli, &raid,
 			  ident_resp_imsi, ARRAY_SIZE(ident_resp_imsi));
 
 	/* check that the MM context has not been removed due to a failed
@@ -1580,7 +1580,7 @@
 	local_tlli = gprs_tmsi2tlli(ptmsi1, TLLI_LOCAL);
 
 	/* inject the attach complete */
-	send_0408_message(ctx->llme, local_tlli, &raid,
+	send_0408_message(ctx->gb.llme, foreign_tlli, &raid,
 			  attach_compl, ARRAY_SIZE(attach_compl));
 
 	OSMO_ASSERT(ctx->mm_state == GMM_REGISTERED_NORMAL);
@@ -1707,7 +1707,7 @@
 	OSMO_ASSERT(sgsn_tx_counter == 1);
 
 	/* inject the identity response (IMEI) */
-	send_0408_message(ctx->llme, foreign_tlli, &raid,
+	send_0408_message(ctx->gb.llme, foreign_tlli, &raid,
 			  ident_resp_imei, ARRAY_SIZE(ident_resp_imei));
 
 	/* check that the MM context has not been removed due to a failed
@@ -1740,7 +1740,7 @@
 
 	/* inject the attach complete */
 	local_tlli = gprs_tmsi2tlli(ptmsi1, TLLI_LOCAL);
-	send_0408_message(ctx->llme, local_tlli, &raid,
+	send_0408_message(ctx->gb.llme, local_tlli, &raid,
 			  attach_compl, ARRAY_SIZE(attach_compl));
 
 	/* we don't expect a response */
@@ -1753,7 +1753,7 @@
 	printf("  - Repeated RA Update Request\n");
 
 	/* inject the RA update request */
-	send_0408_message(ctx->llme, local_tlli, &raid,
+	send_0408_message(ctx->gb.llme, local_tlli, &raid,
 			  ra_upd_req, ARRAY_SIZE(ra_upd_req));
 
 	/* we expect an RA update accept */
@@ -1766,7 +1766,7 @@
 	ptmsi2 = ctx->p_tmsi;
 
 	/* repeat the RA update request */
-	send_0408_message(ctx->llme, local_tlli, &raid,
+	send_0408_message(ctx->gb.llme, local_tlli, &raid,
 			  ra_upd_req, ARRAY_SIZE(ra_upd_req));
 
 	/* we expect an RA update accept */
@@ -1780,7 +1780,7 @@
 
 	/* inject the RA update complete */
 	local_tlli = gprs_tmsi2tlli(ptmsi2, TLLI_LOCAL);
-	send_0408_message(ctx->llme, local_tlli, &raid,
+	send_0408_message(ctx->gb.llme, local_tlli, &raid,
 			  ra_upd_complete, ARRAY_SIZE(ra_upd_complete));
 
 	/* we don't expect a response */
@@ -1791,7 +1791,7 @@
 	OSMO_ASSERT(ctx->p_tmsi == ptmsi2);
 
 	/* inject the detach */
-	send_0408_message(ctx->llme, local_tlli, &raid,
+	send_0408_message(ctx->gb.llme, local_tlli, &raid,
 			  detach_req, ARRAY_SIZE(detach_req));
 
 	/* verify that things are gone */
@@ -1931,7 +1931,7 @@
 	OSMO_ASSERT(last_dl_parse_ctx.tlli == ms_tlli);
 
 	/* inject the identity response (IMEI) */
-	send_0408_message(ctx->llme, ms_tlli, &raid1,
+	send_0408_message(ctx->gb.llme, ms_tlli, &raid1,
 			  ident_resp_imei, ARRAY_SIZE(ident_resp_imei));
 
 	/* check that the MM context has not been removed due to a failed
@@ -1951,7 +1951,7 @@
 
 	/* inject the attach complete */
 	ms_tlli = gprs_tmsi2tlli(ptmsi1, TLLI_LOCAL);
-	send_0408_message(ctx->llme, ms_tlli, &raid1,
+	send_0408_message(ctx->gb.llme, ms_tlli, &raid1,
 			  attach_compl, ARRAY_SIZE(attach_compl));
 
 	/* we don't expect a response */
@@ -1964,7 +1964,7 @@
 	printf("  - RA Update Request (RA 1 -> RA 1)\n");
 
 	/* inject the RA update request */
-	send_0408_message(ctx->llme, ms_tlli, &raid1,
+	send_0408_message(ctx->gb.llme, ms_tlli, &raid1,
 			  ra_upd_req1, ARRAY_SIZE(ra_upd_req1));
 
 	/* we expect an RA update accept */
@@ -1983,7 +1983,7 @@
 
 	/* inject the RA update complete */
 	ms_tlli = gprs_tmsi2tlli(ptmsi1, TLLI_LOCAL);
-	send_0408_message(ctx->llme, ms_tlli, &raid1,
+	send_0408_message(ctx->gb.llme, ms_tlli, &raid1,
 			  ra_upd_complete, ARRAY_SIZE(ra_upd_complete));
 
 	/* we don't expect a response */
@@ -1992,7 +1992,7 @@
 	OSMO_ASSERT(ctx->mm_state == GMM_REGISTERED_NORMAL);
 	OSMO_ASSERT(ctx->p_tmsi_old == 0);
 	OSMO_ASSERT(ctx->p_tmsi == ptmsi1);
-	OSMO_ASSERT(ctx->tlli == ms_tlli);
+	OSMO_ASSERT(ctx->gb.tlli == ms_tlli);
 
 	printf("  - RA Update Request (RA 1 -> RA 2)\n");
 
@@ -2000,7 +2000,7 @@
 	ms_tlli = gprs_tmsi2tlli(ptmsi1, TLLI_FOREIGN);
 
 	/* It is coming from RA 1 => ra_upd_req1 */
-	send_0408_message(ctx->llme, ms_tlli, &raid2,
+	send_0408_message(ctx->gb.llme, ms_tlli, &raid2,
 			  ra_upd_req1, ARRAY_SIZE(ra_upd_req1));
 
 	/* we expect an RA update accept */
@@ -2013,7 +2013,7 @@
 	ms_tlli = gprs_tmsi2tlli(0x12345678, TLLI_FOREIGN);
 
 	/* It is coming from RA 1 => ra_upd_req1 */
-	send_0408_message(ctx->llme, ms_tlli, &raid2,
+	send_0408_message(ctx->gb.llme, ms_tlli, &raid2,
 			  ra_upd_req_other, ARRAY_SIZE(ra_upd_req_other));
 
 	/* we expect an RA update reject (and a LLC XID RESET) */
@@ -2051,7 +2051,7 @@
 	OSMO_ASSERT(ictx != NULL);
 	OSMO_ASSERT(ictx == ctx);
 
-	send_0408_message(ctx->llme, ms_tlli, &raid2,
+	send_0408_message(ctx->gb.llme, ms_tlli, &raid2,
 			  attach_compl, ARRAY_SIZE(attach_compl));
 
 	/* we don't expect a response */
@@ -2064,7 +2064,7 @@
 	printf("  - RA Update Request (RA 2 -> RA 2)\n");
 
 	/* inject the RA update request */
-	send_0408_message(ctx->llme, ms_tlli, &raid2,
+	send_0408_message(ctx->gb.llme, ms_tlli, &raid2,
 			  ra_upd_req2, ARRAY_SIZE(ra_upd_req2));
 
 	/* we expect an RA update accept */
@@ -2082,7 +2082,7 @@
 
 	/* inject the RA update complete */
 	ms_tlli = gprs_tmsi2tlli(ptmsi1, TLLI_LOCAL);
-	send_0408_message(ctx->llme, ms_tlli, &raid2,
+	send_0408_message(ctx->gb.llme, ms_tlli, &raid2,
 			  ra_upd_complete, ARRAY_SIZE(ra_upd_complete));
 
 	/* we don't expect a response */
@@ -2091,11 +2091,11 @@
 	OSMO_ASSERT(ctx->mm_state == GMM_REGISTERED_NORMAL);
 	OSMO_ASSERT(ctx->p_tmsi_old == 0);
 	OSMO_ASSERT(ctx->p_tmsi == ptmsi1);
-	OSMO_ASSERT(ctx->tlli == ms_tlli);
+	OSMO_ASSERT(ctx->gb.tlli == ms_tlli);
 
 
 	/* inject the detach */
-	send_0408_message(ctx->llme, ms_tlli, &raid2,
+	send_0408_message(ctx->gb.llme, ms_tlli, &raid2,
 			  detach_req, ARRAY_SIZE(detach_req));
 
 	/* verify that things are gone */
