IoT: LTE-BL/CE(CAT-M1) Attach Procedure (RRCConnectionSetupComplete and following up signaling)

Upon sending SR, UE would start to monitor MPDCCH in subframe (n+4) for DCI format 6-0A. Upon receiving SR, eNB would schedule UL grant for Msg5 in DCI format 6-0A. According to 36.212 5.3.3.1.10, bit interpretation of DCI format 6-0A is as follows.
I.E. HEX value 015B0220, translated to bits string is 00001010110110000001000100000
0 -> flag DCI format 6-1A or DCI format 6-0A differentiation. 1 means 6-1A and 0 means 6-0A
0 -> frequency hopping flag. 0 means disabled
001 -> ceiling(log2(floor(N_(UL/RB)))/6) = 3 bits, INT value is 1 indicated narrowband index is 1.
01011 -> 5 bits for resource allocation. Refer to 36.213 8.1.1, INT value is 11 means RIV=11, using following equation

RBstart=0 and L_CRBs=6
0110 -> 4 bits for MCS. INT value is 6.
00 -> 2 bits for Repetition number as defined in 36.213 8.0
000 -> 3 bits for HARQ process number
1 -> 1 bit for New Data Indicator. First 1 means new data.
00 -> 2 bits for Redundancy Version. INT value 0 means RV0
01 -> 2 bits for TPC Command for scheduled PUSCH as defined in 36.213 5.1.1.1
UL index field (2 bits) as in 36.213 5.1.1.1, 7.2.1, 8, 8.4 is only for TDD ul/dl configuration0, not present in current example
DAI field (2 bits) as defined in 36.213 7.3 is not present in this example.
0 -> 1 bit for CSI Request
0 -> 1 bit for SRS Request
00 -> 2 bits for DCI subframe repetition number as defined in 36.213 9.1.5

After decoded DCI format 6-0A, UE would transmit PUSCH according to the scheduling information in DCI. For this transmission, UE needs to use RLC AMD and PDCP encryption. Depending on the size of RRCConnectionSetupComplete (NAS AttachRequest pigbacked), 1 UL grant is probably not enough for NAS+RRC message,
I.E. In our example, TBS is 600 bits, if NAS and RRC layer information bits is 1000 bits, 1 UL grant is not enough. In this case, UE would set first RLC AMD SN field to 0 and set header field FI according to following table

UE also needs to set E and LI fields according to 36.322 6.2.2.

After adding RLC header, UE would pass RLC SDU to PDCP layer for PDCP header. Since it is SRB1, PDCP SN length is 5 bits and MAC-I is 32 bits with all set to 0.

Note, in 24.301 8.3.20.2, in order for MME to send ESM Information Request, UE needs to set ESM Information transfer flag to 1 in PDN Connectivity Request.

The rest signaling is no difference compared with legacy LTE.