diff --git a/devices/__init__.py b/devices/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/devices/__init__.py
diff --git a/devices/baicells.py b/devices/baicells.py
new file mode 100644
index 0000000..db7f8c1
--- /dev/null
+++ b/devices/baicells.py
@@ -0,0 +1,313 @@
+"""
+Copyright 2020 The Magma Authors.
+
+This source code is licensed under the BSD-style license found in the
+LICENSE file in the root directory of this source tree.
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+"""
+
+from typing import Any, Callable, Dict, List, Optional, Type
+
+from common.service import MagmaService
+from data_models import transform_for_enb, transform_for_magma
+from data_models.data_model import DataModel, TrParam
+from data_models.data_model_parameters import (
+    ParameterName,
+    TrParameterType,
+)
+from device_config.enodeb_config_postprocessor import (
+    EnodebConfigurationPostProcessor,
+)
+from device_config.enodeb_configuration import EnodebConfiguration
+from devices.device_utils import EnodebDeviceName
+from state_machines.enb_acs_impl import BasicEnodebAcsStateMachine
+from state_machines.enb_acs_states import (
+    AddObjectsState,
+    BaicellsRemWaitState,
+    CheckOptionalParamsState,
+    DeleteObjectsState,
+    EnbSendRebootState,
+    EndSessionState,
+    EnodebAcsState,
+    ErrorState,
+    GetObjectParametersState,
+    GetParametersState,
+    SendGetTransientParametersState,
+    SetParameterValuesState,
+    WaitEmptyMessageState,
+    WaitGetObjectParametersState,
+    WaitGetParametersState,
+    WaitGetTransientParametersState,
+    WaitInformMRebootState,
+    WaitInformState,
+    WaitRebootResponseState,
+    WaitSetParameterValuesState,
+)
+
+
+class BaicellsHandler(BasicEnodebAcsStateMachine):
+    def __init__(
+        self,
+        service: MagmaService,
+    ) -> None:
+        self._state_map = {}
+        super().__init__(service=service, use_param_key=False)
+
+    def reboot_asap(self) -> None:
+        self.transition('reboot')
+
+    def is_enodeb_connected(self) -> bool:
+        return not isinstance(self.state, WaitInformState)
+
+    def _init_state_map(self) -> None:
+        self._state_map = {
+            'wait_inform': WaitInformState(self, when_done='wait_empty', when_boot='wait_rem'),
+            'wait_rem': BaicellsRemWaitState(self, when_done='wait_inform'),
+            'wait_empty': WaitEmptyMessageState(self, when_done='get_transient_params', when_missing='check_optional_params'),
+            'check_optional_params': CheckOptionalParamsState(self, when_done='get_transient_params'),
+            'get_transient_params': SendGetTransientParametersState(self, when_done='wait_get_transient_params'),
+            'wait_get_transient_params': WaitGetTransientParametersState(self, when_get='get_params', when_get_obj_params='get_obj_params', when_delete='delete_objs', when_add='add_objs', when_set='set_params', when_skip='end_session'),
+            'get_params': GetParametersState(self, when_done='wait_get_params'),
+            'wait_get_params': WaitGetParametersState(self, when_done='get_obj_params'),
+            'get_obj_params': GetObjectParametersState(self, when_done='wait_get_obj_params'),
+            'wait_get_obj_params': WaitGetObjectParametersState(self, when_delete='delete_objs', when_add='add_objs', when_set='set_params', when_skip='end_session'),
+            'delete_objs': DeleteObjectsState(self, when_add='add_objs', when_skip='set_params'),
+            'add_objs': AddObjectsState(self, when_done='set_params'),
+            'set_params': SetParameterValuesState(self, when_done='wait_set_params'),
+            'wait_set_params': WaitSetParameterValuesState(self, when_done='check_get_params', when_apply_invasive='reboot'),
+            'check_get_params': GetParametersState(self, when_done='check_wait_get_params', request_all_params=True),
+            'check_wait_get_params': WaitGetParametersState(self, when_done='end_session'),
+            'end_session': EndSessionState(self),
+            'reboot': EnbSendRebootState(self, when_done='wait_reboot'),
+            'wait_reboot': WaitRebootResponseState(self, when_done='wait_post_reboot_inform'),
+            'wait_post_reboot_inform': WaitInformMRebootState(self, when_done='wait_rem_post_reboot', when_timeout='wait_inform_post_reboot'),
+            # After rebooting, we don't need to query optional params again.
+            'wait_inform_post_reboot': WaitInformState(self, when_done='wait_empty_post_reboot', when_boot='wait_rem_post_reboot'),
+            'wait_rem_post_reboot': BaicellsRemWaitState(self, when_done='wait_inform_post_reboot'),
+            'wait_empty_post_reboot': WaitEmptyMessageState(self, when_done='get_transient_params', when_missing='check_optional_params'),
+            # The states below are entered when an unexpected message type is
+            # received
+            'unexpected_fault': ErrorState(self, inform_transition_target='wait_inform'),
+        }
+
+    @property
+    def device_name(self) -> str:
+        return EnodebDeviceName.BAICELLS
+
+    @property
+    def data_model_class(self) -> Type[DataModel]:
+        return BaicellsTrDataModel
+
+    @property
+    def config_postprocessor(self) -> EnodebConfigurationPostProcessor:
+        return BaicellsTrConfigurationInitializer()
+
+    @property
+    def state_map(self) -> Dict[str, EnodebAcsState]:
+        return self._state_map
+
+    @property
+    def disconnected_state_name(self) -> str:
+        return 'wait_inform'
+
+    @property
+    def unexpected_fault_state_name(self) -> str:
+        return 'unexpected_fault'
+
+
+class BaicellsTrDataModel(DataModel):
+    """
+    Class to represent relevant data model parameters from TR-196/TR-098/TR-181.
+    This class is effectively read-only
+
+    This is for any version BaiStation_V100R001C00B110SPC003 or after
+    """
+    # Parameters to query when reading eNodeB config
+    LOAD_PARAMETERS = [ParameterName.DEVICE]
+    # Mapping of TR parameter paths to aliases
+    DEVICE_PATH = 'Device.'
+    FAPSERVICE_PATH = DEVICE_PATH + 'Services.FAPService.1.'
+    PARAMETERS = {
+        # Top-level objects
+        ParameterName.DEVICE: TrParam(DEVICE_PATH, True, TrParameterType.OBJECT, False),
+        ParameterName.FAP_SERVICE: TrParam(FAPSERVICE_PATH, True, TrParameterType.OBJECT, False),
+
+        # Device info parameters
+        ParameterName.GPS_STATUS: TrParam(DEVICE_PATH + 'DeviceInfo.X_BAICELLS_COM_GPS_Status', True, TrParameterType.BOOLEAN, False),
+        ParameterName.PTP_STATUS: TrParam(DEVICE_PATH + 'DeviceInfo.X_BAICELLS_COM_1588_Status', True, TrParameterType.BOOLEAN, False),
+        ParameterName.MME_STATUS: TrParam(DEVICE_PATH + 'DeviceInfo.X_BAICELLS_COM_MME_Status', True, TrParameterType.BOOLEAN, False),
+        ParameterName.REM_STATUS: TrParam(FAPSERVICE_PATH + 'REM.X_BAICELLS_COM_REM_Status', True, TrParameterType.BOOLEAN, False),
+        ParameterName.LOCAL_GATEWAY_ENABLE:
+            TrParam(DEVICE_PATH + 'DeviceInfo.X_BAICELLS_COM_LTE_LGW_Switch', False, TrParameterType.BOOLEAN, False),
+        # Tested Baicells devices were missing this parameter
+        ParameterName.GPS_ENABLE: TrParam(DEVICE_PATH + 'X_BAICELLS_COM_GpsSyncEnable', False, TrParameterType.BOOLEAN, True),
+        ParameterName.GPS_LAT: TrParam(DEVICE_PATH + 'FAP.GPS.LockedLatitude', True, TrParameterType.INT, True),
+        ParameterName.GPS_LONG: TrParam(DEVICE_PATH + 'FAP.GPS.LockedLongitude', True, TrParameterType.INT, True),
+        ParameterName.SW_VERSION: TrParam(DEVICE_PATH + 'DeviceInfo.SoftwareVersion', True, TrParameterType.STRING, False),
+        ParameterName.SERIAL_NUMBER: TrParam(DEVICE_PATH + 'DeviceInfo.SerialNumber', True, TrParameterType.STRING, False),
+
+        # Capabilities
+        ParameterName.DUPLEX_MODE_CAPABILITY: TrParam(
+            FAPSERVICE_PATH + 'Capabilities.LTE.DuplexMode', True, TrParameterType.STRING, False,
+        ),
+        ParameterName.BAND_CAPABILITY: TrParam(FAPSERVICE_PATH + 'Capabilities.LTE.BandsSupported', True, TrParameterType.STRING, False),
+
+        # RF-related parameters
+        ParameterName.EARFCNDL: TrParam(FAPSERVICE_PATH + 'X_BAICELLS_COM_LTE.EARFCNDLInUse', True, TrParameterType.INT, False),
+        ParameterName.EARFCNUL: TrParam(FAPSERVICE_PATH + 'X_BAICELLS_COM_LTE.EARFCNULInUse', True, TrParameterType.INT, False),
+        ParameterName.BAND: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.FreqBandIndicator', True, TrParameterType.INT, False),
+        ParameterName.PCI: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.PhyCellID', False, TrParameterType.INT, False),
+        ParameterName.DL_BANDWIDTH: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.DLBandwidth', True, TrParameterType.STRING, False),
+        ParameterName.UL_BANDWIDTH: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.ULBandwidth', True, TrParameterType.STRING, False),
+        ParameterName.SUBFRAME_ASSIGNMENT: TrParam(
+            FAPSERVICE_PATH
+            + 'CellConfig.LTE.RAN.PHY.TDDFrame.SubFrameAssignment', True, TrParameterType.INT, False,
+        ),
+        ParameterName.SPECIAL_SUBFRAME_PATTERN: TrParam(
+            FAPSERVICE_PATH
+            + 'CellConfig.LTE.RAN.PHY.TDDFrame.SpecialSubframePatterns', True, TrParameterType.INT, False,
+        ),
+        ParameterName.CELL_ID: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.Common.CellIdentity', True, TrParameterType.UNSIGNED_INT, False),
+
+        # Other LTE parameters
+        ParameterName.ADMIN_STATE: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.AdminState', False, TrParameterType.BOOLEAN, False),
+        ParameterName.OP_STATE: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.OpState', True, TrParameterType.BOOLEAN, False),
+        ParameterName.RF_TX_STATUS: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.RFTxStatus', True, TrParameterType.BOOLEAN, False),
+
+        # RAN parameters
+        ParameterName.CELL_RESERVED: TrParam(
+            FAPSERVICE_PATH
+            + 'CellConfig.LTE.RAN.CellRestriction.CellReservedForOperatorUse', True, TrParameterType.BOOLEAN, False,
+        ),
+        ParameterName.CELL_BARRED: TrParam(
+            FAPSERVICE_PATH
+            + 'CellConfig.LTE.RAN.CellRestriction.CellBarred', True, TrParameterType.BOOLEAN, False,
+        ),
+
+        # Core network parameters
+        ParameterName.MME_IP: TrParam(
+            FAPSERVICE_PATH + 'FAPControl.LTE.Gateway.S1SigLinkServerList', True, TrParameterType.STRING, False,
+        ),
+        ParameterName.MME_PORT: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.Gateway.S1SigLinkPort', True, TrParameterType.INT, False),
+        ParameterName.NUM_PLMNS: TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNListNumberOfEntries', True, TrParameterType.INT, False,
+        ),
+        ParameterName.PLMN: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.', True, TrParameterType.STRING, False),
+        # PLMN arrays are added below
+        ParameterName.TAC: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.TAC', True, TrParameterType.INT, False),
+        ParameterName.IP_SEC_ENABLE: TrParam(
+            DEVICE_PATH + 'Services.FAPService.Ipsec.IPSEC_ENABLE', False, TrParameterType.BOOLEAN, False,
+        ),
+        ParameterName.MME_POOL_ENABLE: TrParam(
+            FAPSERVICE_PATH
+            + 'FAPControl.LTE.Gateway.X_BAICELLS_COM_MmePool.Enable', True, TrParameterType.BOOLEAN, False,
+        ),
+
+        # Management server parameters
+        ParameterName.PERIODIC_INFORM_ENABLE:
+            TrParam(DEVICE_PATH + 'ManagementServer.PeriodicInformEnable', False, TrParameterType.BOOLEAN, False),
+        ParameterName.PERIODIC_INFORM_INTERVAL:
+            TrParam(DEVICE_PATH + 'ManagementServer.PeriodicInformInterval', False, TrParameterType.INT, False),
+
+        # Performance management parameters
+        ParameterName.PERF_MGMT_ENABLE: TrParam(
+            DEVICE_PATH + 'FAP.PerfMgmt.Config.1.Enable', False, TrParameterType.BOOLEAN, False,
+        ),
+        ParameterName.PERF_MGMT_UPLOAD_INTERVAL: TrParam(
+            DEVICE_PATH + 'FAP.PerfMgmt.Config.1.PeriodicUploadInterval', False, TrParameterType.INT, False,
+        ),
+        ParameterName.PERF_MGMT_UPLOAD_URL: TrParam(
+            DEVICE_PATH + 'FAP.PerfMgmt.Config.1.URL', False, TrParameterType.STRING, False,
+        ),
+
+    }
+
+    NUM_PLMNS_IN_CONFIG = 6
+    for i in range(1, NUM_PLMNS_IN_CONFIG + 1):
+        PARAMETERS[(ParameterName.PLMN_N) % i] = TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.' % i, True, TrParameterType.STRING, False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_CELL_RESERVED % i] = TrParam(
+            FAPSERVICE_PATH
+            + 'CellConfig.LTE.EPC.PLMNList.%d.CellReservedForOperatorUse' % i, True, TrParameterType.BOOLEAN, False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_ENABLE % i] = TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.Enable' % i, True, TrParameterType.BOOLEAN, False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_PRIMARY % i] = TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.IsPrimary' % i, True, TrParameterType.BOOLEAN, False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_PLMNID % i] = TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.PLMNID' % i, True, TrParameterType.STRING, False,
+        )
+
+    TRANSFORMS_FOR_ENB = {
+        ParameterName.DL_BANDWIDTH: transform_for_enb.bandwidth,
+        ParameterName.UL_BANDWIDTH: transform_for_enb.bandwidth,
+    }
+    TRANSFORMS_FOR_MAGMA = {
+        ParameterName.DL_BANDWIDTH: transform_for_magma.bandwidth,
+        ParameterName.UL_BANDWIDTH: transform_for_magma.bandwidth,
+        # We don't set GPS, so we don't need transform for enb
+        ParameterName.GPS_LAT: transform_for_magma.gps_tr181,
+        ParameterName.GPS_LONG: transform_for_magma.gps_tr181,
+    }
+
+    @classmethod
+    def get_parameter(cls, param_name: ParameterName) -> Optional[TrParam]:
+        return cls.PARAMETERS.get(param_name)
+
+    @classmethod
+    def _get_magma_transforms(
+        cls,
+    ) -> Dict[ParameterName, Callable[[Any], Any]]:
+        return cls.TRANSFORMS_FOR_MAGMA
+
+    @classmethod
+    def _get_enb_transforms(cls) -> Dict[ParameterName, Callable[[Any], Any]]:
+        return cls.TRANSFORMS_FOR_ENB
+
+    @classmethod
+    def get_load_parameters(cls) -> List[ParameterName]:
+        return cls.LOAD_PARAMETERS
+
+    @classmethod
+    def get_num_plmns(cls) -> int:
+        return cls.NUM_PLMNS_IN_CONFIG
+
+    @classmethod
+    def get_parameter_names(cls) -> List[ParameterName]:
+        excluded_params = [
+            str(ParameterName.DEVICE),
+            str(ParameterName.FAP_SERVICE),
+        ]
+        names = list(
+            filter(
+                lambda x: (not str(x).startswith('PLMN'))
+                and (str(x) not in excluded_params),
+                cls.PARAMETERS.keys(),
+            ),
+        )
+        return names
+
+    @classmethod
+    def get_numbered_param_names(cls) -> Dict[ParameterName, List[ParameterName]]:
+        names = {}
+        for i in range(1, cls.NUM_PLMNS_IN_CONFIG + 1):
+            params = []
+            params.append(ParameterName.PLMN_N_CELL_RESERVED % i)
+            params.append(ParameterName.PLMN_N_ENABLE % i)
+            params.append(ParameterName.PLMN_N_PRIMARY % i)
+            params.append(ParameterName.PLMN_N_PLMNID % i)
+            names[ParameterName.PLMN_N % i] = params
+        return names
+
+
+class BaicellsTrConfigurationInitializer(EnodebConfigurationPostProcessor):
+    def postprocess(self, mconfig: Any, service_cfg: Any, desired_cfg: EnodebConfiguration) -> None:
+        desired_cfg.set_parameter(ParameterName.CELL_BARRED, False)
diff --git a/devices/baicells_old.py b/devices/baicells_old.py
new file mode 100644
index 0000000..f5db4b5
--- /dev/null
+++ b/devices/baicells_old.py
@@ -0,0 +1,329 @@
+"""
+Copyright 2020 The Magma Authors.
+
+This source code is licensed under the BSD-style license found in the
+LICENSE file in the root directory of this source tree.
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+"""
+
+from typing import Any, Callable, Dict, List, Optional, Type
+
+from common.service import MagmaService
+from data_models import transform_for_enb, transform_for_magma
+from data_models.data_model import DataModel, TrParam
+from data_models.data_model_parameters import (
+    ParameterName,
+    TrParameterType,
+)
+from device_config.enodeb_config_postprocessor import (
+    EnodebConfigurationPostProcessor,
+)
+from device_config.enodeb_configuration import EnodebConfiguration
+from devices.device_utils import EnodebDeviceName
+from state_machines.enb_acs_impl import BasicEnodebAcsStateMachine
+from state_machines.enb_acs_states import (
+    AddObjectsState,
+    BaicellsRemWaitState,
+    CheckOptionalParamsState,
+    DeleteObjectsState,
+    EnbSendRebootState,
+    EndSessionState,
+    EnodebAcsState,
+    ErrorState,
+    GetObjectParametersState,
+    GetParametersState,
+    SendGetTransientParametersState,
+    SetParameterValuesState,
+    WaitEmptyMessageState,
+    WaitGetObjectParametersState,
+    WaitGetParametersState,
+    WaitGetTransientParametersState,
+    WaitInformMRebootState,
+    WaitInformState,
+    WaitRebootResponseState,
+    WaitSetParameterValuesState,
+)
+
+
+class BaicellsOldHandler(BasicEnodebAcsStateMachine):
+    def __init__(
+            self,
+            service: MagmaService,
+    ) -> None:
+        self._state_map = {}
+        super().__init__(service=service, use_param_key=False)
+
+    def reboot_asap(self) -> None:
+        self.transition('reboot')
+
+    def is_enodeb_connected(self) -> bool:
+        return not isinstance(self.state, WaitInformState)
+
+    def _init_state_map(self) -> None:
+        self._state_map = {
+            'wait_inform': WaitInformState(self, when_done='wait_empty', when_boot='wait_rem'),
+            'wait_rem': BaicellsRemWaitState(self, when_done='wait_inform'),
+            'wait_empty': WaitEmptyMessageState(self, when_done='get_transient_params', when_missing='check_optional_params'),
+            'check_optional_params': CheckOptionalParamsState(self, when_done='get_transient_params'),
+            'get_transient_params': SendGetTransientParametersState(self, when_done='wait_get_transient_params'),
+            'wait_get_transient_params': WaitGetTransientParametersState(self, when_get='get_params', when_get_obj_params='get_obj_params', when_delete='delete_objs', when_add='add_objs', when_set='set_params', when_skip='end_session'),
+            'get_params': GetParametersState(self, when_done='wait_get_params'),
+            'wait_get_params': WaitGetParametersState(self, when_done='get_obj_params'),
+            'get_obj_params': GetObjectParametersState(self, when_done='wait_get_obj_params'),
+            'wait_get_obj_params': WaitGetObjectParametersState(self, when_delete='delete_objs', when_add='add_objs', when_set='set_params', when_skip='end_session'),
+            'delete_objs': DeleteObjectsState(self, when_add='add_objs', when_skip='set_params'),
+            'add_objs': AddObjectsState(self, when_done='set_params'),
+            'set_params': SetParameterValuesState(self, when_done='wait_set_params'),
+            'wait_set_params': WaitSetParameterValuesState(self, when_done='check_get_params', when_apply_invasive='reboot'),
+            'check_get_params': GetParametersState(self, when_done='check_wait_get_params', request_all_params=True),
+            'check_wait_get_params': WaitGetParametersState(self, when_done='end_session'),
+            'end_session': EndSessionState(self),
+            'reboot': EnbSendRebootState(self, when_done='wait_reboot'),
+            'wait_reboot': WaitRebootResponseState(self, when_done='wait_post_reboot_inform'),
+            'wait_post_reboot_inform': WaitInformMRebootState(self, when_done='wait_rem_post_reboot', when_timeout='wait_inform_post_reboot'),
+            # After rebooting, we don't need to query optional params again.
+            'wait_inform_post_reboot': WaitInformState(self, when_done='wait_empty_post_reboot', when_boot='wait_rem_post_reboot'),
+            'wait_rem_post_reboot': BaicellsRemWaitState(self, when_done='wait_inform_post_reboot'),
+            'wait_empty_post_reboot': WaitEmptyMessageState(self, when_done='get_transient_params', when_missing='check_optional_params'),
+            # The states below are entered when an unexpected message type is
+            # received
+            'unexpected_fault': ErrorState(self, inform_transition_target='wait_inform'),
+        }
+
+    @property
+    def device_name(self) -> str:
+        return EnodebDeviceName.BAICELLS_OLD
+
+    @property
+    def data_model_class(self) -> Type[DataModel]:
+        return BaicellsTrOldDataModel
+
+    @property
+    def config_postprocessor(self) -> EnodebConfigurationPostProcessor:
+        return BaicellsTrOldConfigurationInitializer()
+
+    @property
+    def state_map(self) -> Dict[str, EnodebAcsState]:
+        return self._state_map
+
+    @property
+    def disconnected_state_name(self) -> str:
+        return 'wait_inform'
+
+    @property
+    def unexpected_fault_state_name(self) -> str:
+        return 'unexpected_fault'
+
+
+class BaicellsTrOldDataModel(DataModel):
+    """
+    Class to represent relevant data model parameters from
+    TR-196/TR-098/TR-181.
+
+    This class is effectively read-only
+
+    This is for any version before BaiStation_V100R001C00B110SPC003
+
+    Some eNodeBs have a bug where the meaning of the following parameter is
+    inverted:
+    Device.Services.FAPService.1.CellConfig.LTE.EPC.PLMNList.1.CellReservedForOperatorUse
+    I.e. CellReservedForOperatorUse = True in TR-196 results in the relevant
+    SIB parameter being advertised as 'CellReservedForOperatorUse notReserved',
+    and vice versa.
+
+    This issue was fixed in the above SW version, so the flag should be
+    inverted for the all versions PRECEEDING
+
+    The same problem exists for 'cell barred'. See above description
+    """
+    # Parameters to query when reading eNodeB config
+    LOAD_PARAMETERS = [ParameterName.DEVICE]
+    # Mapping of TR parameter paths to aliases
+    DEVICE_PATH = 'Device.'
+    FAPSERVICE_PATH = DEVICE_PATH + 'Services.FAPService.1.'
+    PARAMETERS = {
+        # Top-level objects
+        ParameterName.DEVICE: TrParam(DEVICE_PATH, True, TrParameterType.OBJECT, False),
+        ParameterName.FAP_SERVICE: TrParam(FAPSERVICE_PATH, True, TrParameterType.OBJECT, False),
+
+        # Device info parameters
+        ParameterName.GPS_STATUS: TrParam(DEVICE_PATH + 'DeviceInfo.X_BAICELLS_COM_GPS_Status', True, TrParameterType.BOOLEAN, False),
+        ParameterName.PTP_STATUS: TrParam(DEVICE_PATH + 'DeviceInfo.X_BAICELLS_COM_1588_Status', True, TrParameterType.BOOLEAN, False),
+        ParameterName.MME_STATUS: TrParam(DEVICE_PATH + 'DeviceInfo.X_BAICELLS_COM_MME_Status', True, TrParameterType.BOOLEAN, False),
+        ParameterName.REM_STATUS: TrParam(FAPSERVICE_PATH + 'REM.X_BAICELLS_COM_REM_Status', True, TrParameterType.BOOLEAN, True),
+        ParameterName.LOCAL_GATEWAY_ENABLE:
+            TrParam(DEVICE_PATH + 'DeviceInfo.X_BAICELLS_COM_LTE_LGW_Switch', False, TrParameterType.BOOLEAN, False),
+        ParameterName.GPS_ENABLE: TrParam(DEVICE_PATH + 'X_BAICELLS_COM_GpsSyncEnable', False, TrParameterType.BOOLEAN, True),
+        ParameterName.GPS_LAT: TrParam(DEVICE_PATH + 'FAP.GPS.LockedLatitude', True, TrParameterType.INT, True),
+        ParameterName.GPS_LONG: TrParam(DEVICE_PATH + 'FAP.GPS.LockedLongitude', True, TrParameterType.INT, True),
+        ParameterName.SW_VERSION: TrParam(DEVICE_PATH + 'DeviceInfo.SoftwareVersion', True, TrParameterType.STRING, False),
+        ParameterName.SERIAL_NUMBER: TrParam(DEVICE_PATH + 'DeviceInfo.SerialNumber', True, TrParameterType.STRING, False),
+
+        # Capabilities
+        ParameterName.DUPLEX_MODE_CAPABILITY: TrParam(
+            FAPSERVICE_PATH + 'Capabilities.LTE.DuplexMode', True, TrParameterType.STRING, False,
+        ),
+        ParameterName.BAND_CAPABILITY: TrParam(FAPSERVICE_PATH + 'Capabilities.LTE.BandsSupported', True, TrParameterType.STRING, False),
+
+        # RF-related parameters
+        ParameterName.EARFCNDL: TrParam(FAPSERVICE_PATH + 'X_BAICELLS_COM_LTE.EARFCNDLInUse', True, TrParameterType.INT, False),
+        ParameterName.EARFCNUL: TrParam(FAPSERVICE_PATH + 'X_BAICELLS_COM_LTE.EARFCNULInUse', True, TrParameterType.INT, False),
+        ParameterName.BAND: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.FreqBandIndicator', True, TrParameterType.INT, False),
+        ParameterName.PCI: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.PhyCellID', True, TrParameterType.INT, False),
+        ParameterName.DL_BANDWIDTH: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.DLBandwidth', True, TrParameterType.STRING, False),
+        ParameterName.UL_BANDWIDTH: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.ULBandwidth', True, TrParameterType.STRING, False),
+        ParameterName.SUBFRAME_ASSIGNMENT: TrParam(
+            FAPSERVICE_PATH
+            + 'CellConfig.LTE.RAN.PHY.TDDFrame.SubFrameAssignment', True, TrParameterType.INT, False,
+        ),
+        ParameterName.SPECIAL_SUBFRAME_PATTERN: TrParam(
+            FAPSERVICE_PATH
+            + 'CellConfig.LTE.RAN.PHY.TDDFrame.SpecialSubframePatterns', True, TrParameterType.INT, False,
+        ),
+        ParameterName.CELL_ID: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.Common.CellIdentity', True, TrParameterType.UNSIGNED_INT, False),
+
+        # Other LTE parameters
+        ParameterName.ADMIN_STATE: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.AdminState', False, TrParameterType.BOOLEAN, False),
+        ParameterName.OP_STATE: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.OpState', True, TrParameterType.BOOLEAN, False),
+        ParameterName.RF_TX_STATUS: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.RFTxStatus', True, TrParameterType.BOOLEAN, False),
+
+        # RAN parameters
+        ParameterName.CELL_RESERVED: TrParam(
+            FAPSERVICE_PATH
+            + 'CellConfig.LTE.RAN.CellRestriction.CellReservedForOperatorUse', True, TrParameterType.BOOLEAN, False,
+        ),
+        ParameterName.CELL_BARRED: TrParam(
+            FAPSERVICE_PATH
+            + 'CellConfig.LTE.RAN.CellRestriction.CellBarred', True, TrParameterType.BOOLEAN, False,
+        ),
+
+        # Core network parameters
+        ParameterName.MME_IP: TrParam(
+            FAPSERVICE_PATH + 'FAPControl.LTE.Gateway.S1SigLinkServerList', True, TrParameterType.STRING, False,
+        ),
+        ParameterName.MME_PORT: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.Gateway.S1SigLinkPort', True, TrParameterType.INT, False),
+        ParameterName.NUM_PLMNS: TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNListNumberOfEntries', True, TrParameterType.INT, False,
+        ),
+        ParameterName.PLMN: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.', True, TrParameterType.STRING, False),
+        # PLMN arrays are added below
+        ParameterName.TAC: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.TAC', True, TrParameterType.INT, False),
+        ParameterName.IP_SEC_ENABLE: TrParam(
+            DEVICE_PATH + 'Services.FAPService.Ipsec.IPSEC_ENABLE', False, TrParameterType.BOOLEAN, False,
+        ),
+        ParameterName.MME_POOL_ENABLE: TrParam(
+            FAPSERVICE_PATH +
+            'FAPControl.LTE.Gateway.X_BAICELLS_COM_MmePool.Enable', True, TrParameterType.BOOLEAN, True,
+        ),
+
+        # Management server parameters
+        ParameterName.PERIODIC_INFORM_ENABLE:
+            TrParam(DEVICE_PATH + 'ManagementServer.PeriodicInformEnable', False, TrParameterType.BOOLEAN, False),
+        ParameterName.PERIODIC_INFORM_INTERVAL:
+            TrParam(DEVICE_PATH + 'ManagementServer.PeriodicInformInterval', False, TrParameterType.INT, False),
+
+        # Performance management parameters
+        ParameterName.PERF_MGMT_ENABLE: TrParam(
+            DEVICE_PATH + 'FAP.PerfMgmt.Config.1.Enable', False, TrParameterType.BOOLEAN, False,
+        ),
+        ParameterName.PERF_MGMT_UPLOAD_INTERVAL: TrParam(
+            DEVICE_PATH + 'FAP.PerfMgmt.Config.1.PeriodicUploadInterval', False, TrParameterType.INT, False,
+        ),
+        ParameterName.PERF_MGMT_UPLOAD_URL: TrParam(
+            DEVICE_PATH + 'FAP.PerfMgmt.Config.1.URL', False, TrParameterType.STRING, False,
+        ),
+
+    }
+
+    NUM_PLMNS_IN_CONFIG = 6
+    for i in range(1, NUM_PLMNS_IN_CONFIG + 1):
+        PARAMETERS[(ParameterName.PLMN_N) % i] = TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.' % i, True, TrParameterType.STRING, False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_CELL_RESERVED % i] = TrParam(
+            FAPSERVICE_PATH +
+            'CellConfig.LTE.EPC.PLMNList.%d.CellReservedForOperatorUse' % i, True, TrParameterType.BOOLEAN, False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_ENABLE % i] = TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.Enable' % i, True, TrParameterType.BOOLEAN, False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_PRIMARY % i] = TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.IsPrimary' % i, True, TrParameterType.BOOLEAN, False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_PLMNID % i] = TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.PLMNID' % i, True, TrParameterType.STRING, False,
+        )
+
+    TRANSFORMS_FOR_ENB = {
+        ParameterName.DL_BANDWIDTH: transform_for_enb.bandwidth,
+        ParameterName.UL_BANDWIDTH: transform_for_enb.bandwidth,
+        ParameterName.CELL_BARRED: transform_for_enb.invert_cell_barred,
+        ParameterName.CELL_RESERVED: transform_for_enb.invert_cell_reserved,
+    }
+    TRANSFORMS_FOR_MAGMA = {
+        ParameterName.DL_BANDWIDTH: transform_for_magma.bandwidth,
+        ParameterName.UL_BANDWIDTH: transform_for_magma.bandwidth,
+        # We don't set GPS, so we don't need transform for enb
+        ParameterName.GPS_LAT: transform_for_magma.gps_tr181,
+        ParameterName.GPS_LONG: transform_for_magma.gps_tr181,
+    }
+
+    @classmethod
+    def get_parameter(cls, param_name: ParameterName) -> Optional[TrParam]:
+        return cls.PARAMETERS.get(param_name)
+
+    @classmethod
+    def _get_magma_transforms(
+        cls,
+    ) -> Dict[ParameterName, Callable[[Any], Any]]:
+        return cls.TRANSFORMS_FOR_MAGMA
+
+    @classmethod
+    def _get_enb_transforms(cls) -> Dict[ParameterName, Callable[[Any], Any]]:
+        return cls.TRANSFORMS_FOR_ENB
+
+    @classmethod
+    def get_load_parameters(cls) -> List[ParameterName]:
+        return cls.LOAD_PARAMETERS
+
+    @classmethod
+    def get_num_plmns(cls) -> int:
+        return cls.NUM_PLMNS_IN_CONFIG
+
+    @classmethod
+    def get_parameter_names(cls) -> List[ParameterName]:
+        excluded_params = [
+            str(ParameterName.DEVICE),
+            str(ParameterName.FAP_SERVICE),
+        ]
+        names = list(
+            filter(
+                lambda x: (not str(x).startswith('PLMN'))
+                and (str(x) not in excluded_params),
+                cls.PARAMETERS.keys(),
+            ),
+        )
+        return names
+
+    @classmethod
+    def get_numbered_param_names(cls) -> Dict[ParameterName, List[ParameterName]]:
+        names = {}
+        for i in range(1, cls.NUM_PLMNS_IN_CONFIG + 1):
+            params = []
+            params.append(ParameterName.PLMN_N_CELL_RESERVED % i)
+            params.append(ParameterName.PLMN_N_ENABLE % i)
+            params.append(ParameterName.PLMN_N_PRIMARY % i)
+            params.append(ParameterName.PLMN_N_PLMNID % i)
+            names[ParameterName.PLMN_N % i] = params
+
+        return names
+
+
+class BaicellsTrOldConfigurationInitializer(EnodebConfigurationPostProcessor):
+    def postprocess(self, mconfig: Any, service_cfg: Any, desired_cfg: EnodebConfiguration) -> None:
+        desired_cfg.set_parameter(ParameterName.CELL_BARRED, False)
diff --git a/devices/baicells_qafa.py b/devices/baicells_qafa.py
new file mode 100644
index 0000000..e30a59b
--- /dev/null
+++ b/devices/baicells_qafa.py
@@ -0,0 +1,271 @@
+"""
+Copyright 2020 The Magma Authors.
+
+This source code is licensed under the BSD-style license found in the
+LICENSE file in the root directory of this source tree.
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+"""
+
+from typing import Any, Callable, Dict, List, Optional, Type
+
+from common.service import MagmaService
+from data_models import transform_for_enb, transform_for_magma
+from data_models.data_model import DataModel, TrParam
+from data_models.data_model_parameters import (
+    ParameterName,
+    TrParameterType,
+)
+from device_config.enodeb_config_postprocessor import (
+    EnodebConfigurationPostProcessor,
+)
+from device_config.enodeb_configuration import EnodebConfiguration
+from devices.baicells_qafb import (
+    BaicellsQafbGetObjectParametersState,
+    BaicellsQafbWaitGetTransientParametersState,
+)
+from devices.device_utils import EnodebDeviceName
+from state_machines.enb_acs_impl import BasicEnodebAcsStateMachine
+from state_machines.enb_acs_states import (
+    AddObjectsState,
+    DeleteObjectsState,
+    EnbSendRebootState,
+    EndSessionState,
+    EnodebAcsState,
+    ErrorState,
+    GetParametersState,
+    GetRPCMethodsState,
+    SendGetTransientParametersState,
+    SetParameterValuesState,
+    WaitEmptyMessageState,
+    WaitGetParametersState,
+    WaitInformMRebootState,
+    WaitInformState,
+    WaitRebootResponseState,
+    WaitSetParameterValuesState,
+)
+
+
+class BaicellsQAFAHandler(BasicEnodebAcsStateMachine):
+    def __init__(
+        self,
+        service: MagmaService,
+    ) -> None:
+        self._state_map = {}
+        super().__init__(service=service, use_param_key=False)
+
+    def reboot_asap(self) -> None:
+        self.transition('reboot')
+
+    def is_enodeb_connected(self) -> bool:
+        return not isinstance(self.state, WaitInformState)
+
+    def _init_state_map(self) -> None:
+        self._state_map = {
+            'wait_inform': WaitInformState(self, when_done='get_rpc_methods'),
+            'get_rpc_methods': GetRPCMethodsState(self, when_done='wait_empty', when_skip='get_transient_params'),
+            'wait_empty': WaitEmptyMessageState(self, when_done='get_transient_params'),
+            'get_transient_params': SendGetTransientParametersState(self, when_done='wait_get_transient_params'),
+            'wait_get_transient_params': BaicellsQafbWaitGetTransientParametersState(self, when_get='get_params', when_get_obj_params='get_obj_params', when_delete='delete_objs', when_add='add_objs', when_set='set_params', when_skip='end_session'),
+            'get_params': GetParametersState(self, when_done='wait_get_params'),
+            'wait_get_params': WaitGetParametersState(self, when_done='get_obj_params'),
+            'get_obj_params': BaicellsQafbGetObjectParametersState(self, when_delete='delete_objs', when_add='add_objs', when_set='set_params', when_skip='end_session'),
+            'delete_objs': DeleteObjectsState(self, when_add='add_objs', when_skip='set_params'),
+            'add_objs': AddObjectsState(self, when_done='set_params'),
+            'set_params': SetParameterValuesState(self, when_done='wait_set_params'),
+            'wait_set_params': WaitSetParameterValuesState(self, when_done='check_get_params', when_apply_invasive='check_get_params'),
+            'check_get_params': GetParametersState(self, when_done='check_wait_get_params', request_all_params=True),
+            'check_wait_get_params': WaitGetParametersState(self, when_done='end_session'),
+            'end_session': EndSessionState(self),
+            # These states are only entered through manual user intervention
+            'reboot': EnbSendRebootState(self, when_done='wait_reboot'),
+            'wait_reboot': WaitRebootResponseState(self, when_done='wait_post_reboot_inform'),
+            'wait_post_reboot_inform': WaitInformMRebootState(self, when_done='wait_empty', when_timeout='wait_inform'),
+            # The states below are entered when an unexpected message type is
+            # received
+            'unexpected_fault': ErrorState(self, inform_transition_target='wait_inform'),
+        }
+
+    @property
+    def device_name(self) -> str:
+        return EnodebDeviceName.BAICELLS_QAFA
+
+    @property
+    def data_model_class(self) -> Type[DataModel]:
+        return BaicellsQAFATrDataModel
+
+    @property
+    def config_postprocessor(self) -> EnodebConfigurationPostProcessor:
+        return BaicellsQAFATrConfigurationInitializer()
+
+    @property
+    def state_map(self) -> Dict[str, EnodebAcsState]:
+        return self._state_map
+
+    @property
+    def disconnected_state_name(self) -> str:
+        return 'wait_inform'
+
+    @property
+    def unexpected_fault_state_name(self) -> str:
+        return 'unexpected_fault'
+
+
+class BaicellsQAFATrDataModel(DataModel):
+    """
+    Class to represent relevant data model parameters from TR-196/TR-098.
+    This class is effectively read-only.
+
+    This model specifically targets Qualcomm-based BaiCells units running
+    QAFA firmware.
+
+    These models have these idiosyncrasies (on account of running TR098):
+
+    - Parameter content root is different (InternetGatewayDevice)
+    - GetParameter queries with a wildcard e.g. InternetGatewayDevice. do
+      not respond with the full tree (we have to query all parameters)
+    - MME status is not exposed - we assume the MME is connected if
+      the eNodeB is transmitting (OpState=true)
+    - Parameters such as band capability/duplex config
+      are rooted under `boardconf.` and not the device config root
+    - Parameters like Admin state, CellReservedForOperatorUse,
+      Duplex mode, DL bandwidth and Band capability have different
+      formats from Intel-based Baicells units, necessitating,
+      formatting before configuration and transforming values
+      read from eNodeB state.
+    - Num PLMNs is not reported by these units
+    """
+    # Mapping of TR parameter paths to aliases
+    DEVICE_PATH = 'InternetGatewayDevice.'
+    FAPSERVICE_PATH = DEVICE_PATH + 'Services.FAPService.1.'
+    EEPROM_PATH = 'boardconf.status.eepromInfo.'
+    PARAMETERS = {
+        # Top-level objects
+        ParameterName.DEVICE: TrParam(DEVICE_PATH, True, TrParameterType.OBJECT, False),
+        ParameterName.FAP_SERVICE: TrParam(FAPSERVICE_PATH, True, TrParameterType.OBJECT, False),
+
+        # Qualcomm units do not expose MME_Status (We assume that the eNB is broadcasting state is connected to the MME)
+        ParameterName.MME_STATUS: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.OpState', True, TrParameterType.BOOLEAN, False),
+        ParameterName.GPS_LAT: TrParam(DEVICE_PATH + 'FAP.GPS.latitude', True, TrParameterType.STRING, False),
+        ParameterName.GPS_LONG: TrParam(DEVICE_PATH + 'FAP.GPS.longitude', True, TrParameterType.STRING, False),
+        ParameterName.SW_VERSION: TrParam(DEVICE_PATH + 'DeviceInfo.SoftwareVersion', True, TrParameterType.STRING, False),
+        ParameterName.SERIAL_NUMBER: TrParam(DEVICE_PATH + 'DeviceInfo.SerialNumber', True, TrParameterType.STRING, False),
+
+        # Capabilities
+        ParameterName.DUPLEX_MODE_CAPABILITY: TrParam(EEPROM_PATH + 'div_multiple', True, TrParameterType.STRING, False),
+        ParameterName.BAND_CAPABILITY: TrParam(EEPROM_PATH + 'work_mode', True, TrParameterType.STRING, False),
+
+        # RF-related parameters
+        ParameterName.EARFCNDL: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.EARFCNDL', True, TrParameterType.INT, False),
+        ParameterName.PCI: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.PhyCellID', True, TrParameterType.INT, False),
+        ParameterName.DL_BANDWIDTH: TrParam(DEVICE_PATH + 'Services.RfConfig.1.RfCarrierCommon.carrierBwMhz', True, TrParameterType.INT, False),
+        ParameterName.SUBFRAME_ASSIGNMENT: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.PHY.TDDFrame.SubFrameAssignment', True, 'bool', False),
+        ParameterName.SPECIAL_SUBFRAME_PATTERN: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.PHY.TDDFrame.SpecialSubframePatterns', True, TrParameterType.INT, False),
+        ParameterName.CELL_ID: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.Common.CellIdentity', True, TrParameterType.UNSIGNED_INT, False),
+
+        # Other LTE parameters
+        ParameterName.ADMIN_STATE: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.AdminState', False, TrParameterType.STRING, False),
+        ParameterName.OP_STATE: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.OpState', True, TrParameterType.BOOLEAN, False),
+        ParameterName.RF_TX_STATUS: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.OpState', True, TrParameterType.BOOLEAN, False),
+
+        # Core network parameters
+        ParameterName.MME_IP: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.Gateway.S1SigLinkServerList', True, TrParameterType.STRING, False),
+        ParameterName.MME_PORT: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.Gateway.S1SigLinkPort', True, TrParameterType.INT, False),
+        # This parameter is standard but doesn't exist
+        # ParameterName.NUM_PLMNS: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNListNumberOfEntries', True, TrParameterType.INT, False),
+        ParameterName.TAC: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.TAC', True, TrParameterType.INT, False),
+        ParameterName.IP_SEC_ENABLE: TrParam('boardconf.ipsec.ipsecConfig.onBoot', False, TrParameterType.BOOLEAN, False),
+
+        # Management server parameters
+        ParameterName.PERIODIC_INFORM_ENABLE: TrParam(DEVICE_PATH + 'ManagementServer.PeriodicInformEnable', False, TrParameterType.BOOLEAN, False),
+        ParameterName.PERIODIC_INFORM_INTERVAL: TrParam(DEVICE_PATH + 'ManagementServer.PeriodicInformInterval', False, TrParameterType.INT, False),
+
+        # Performance management parameters
+        ParameterName.PERF_MGMT_ENABLE: TrParam(DEVICE_PATH + 'FAP.PerfMgmt.Config.Enable', False, TrParameterType.BOOLEAN, False),
+        ParameterName.PERF_MGMT_UPLOAD_INTERVAL: TrParam(DEVICE_PATH + 'FAP.PerfMgmt.Config.PeriodicUploadInterval', False, TrParameterType.INT, False),
+        ParameterName.PERF_MGMT_UPLOAD_URL: TrParam(DEVICE_PATH + 'FAP.PerfMgmt.Config.URL', False, TrParameterType.STRING, False),
+    }
+
+    NUM_PLMNS_IN_CONFIG = 6
+    TRANSFORMS_FOR_ENB = {
+        ParameterName.CELL_BARRED: transform_for_enb.invert_cell_barred,
+    }
+    for i in range(1, NUM_PLMNS_IN_CONFIG + 1):
+        TRANSFORMS_FOR_ENB[ParameterName.PLMN_N_CELL_RESERVED % i] = transform_for_enb.cell_reserved
+        PARAMETERS[ParameterName.PLMN_N % i] = TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.' % i, True, TrParameterType.STRING, False)
+        PARAMETERS[ParameterName.PLMN_N_CELL_RESERVED % i] = TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.CellReservedForOperatorUse' % i, True, TrParameterType.STRING, False)
+        PARAMETERS[ParameterName.PLMN_N_ENABLE % i] = TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.Enable' % i, True, TrParameterType.BOOLEAN, False)
+        PARAMETERS[ParameterName.PLMN_N_PRIMARY % i] = TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.IsPrimary' % i, True, TrParameterType.BOOLEAN, False)
+        PARAMETERS[ParameterName.PLMN_N_PLMNID % i] = TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.PLMNID' % i, True, TrParameterType.STRING, False)
+
+    TRANSFORMS_FOR_ENB[ParameterName.ADMIN_STATE] = transform_for_enb.admin_state
+    TRANSFORMS_FOR_MAGMA = {
+        # We don't set these parameters
+        ParameterName.BAND_CAPABILITY: transform_for_magma.band_capability,
+        ParameterName.DUPLEX_MODE_CAPABILITY: transform_for_magma.duplex_mode,
+    }
+
+    @classmethod
+    def get_parameter(cls, param_name: ParameterName) -> Optional[TrParam]:
+        return cls.PARAMETERS.get(param_name)
+
+    @classmethod
+    def _get_magma_transforms(
+        cls,
+    ) -> Dict[ParameterName, Callable[[Any], Any]]:
+        return cls.TRANSFORMS_FOR_MAGMA
+
+    @classmethod
+    def _get_enb_transforms(cls) -> Dict[ParameterName, Callable[[Any], Any]]:
+        return cls.TRANSFORMS_FOR_ENB
+
+    @classmethod
+    def get_load_parameters(cls) -> List[ParameterName]:
+        """
+        Load all the parameters instead of a subset.
+        """
+        return list(cls.PARAMETERS.keys())
+
+    @classmethod
+    def get_num_plmns(cls) -> int:
+        return cls.NUM_PLMNS_IN_CONFIG
+
+    @classmethod
+    def get_parameter_names(cls) -> List[ParameterName]:
+        excluded_params = [
+            str(ParameterName.DEVICE),
+            str(ParameterName.FAP_SERVICE),
+        ]
+        names = list(
+            filter(
+                lambda x: (not str(x).startswith('PLMN'))
+                and (str(x) not in excluded_params),
+                cls.PARAMETERS.keys(),
+            ),
+        )
+        return names
+
+    @classmethod
+    def get_numbered_param_names(
+        cls,
+    ) -> Dict[ParameterName, List[ParameterName]]:
+        names = {}
+        for i in range(1, cls.NUM_PLMNS_IN_CONFIG + 1):
+            params = []
+            params.append(ParameterName.PLMN_N_CELL_RESERVED % i)
+            params.append(ParameterName.PLMN_N_ENABLE % i)
+            params.append(ParameterName.PLMN_N_PRIMARY % i)
+            params.append(ParameterName.PLMN_N_PLMNID % i)
+            names[ParameterName.PLMN_N % i] = params
+
+        return names
+
+
+class BaicellsQAFATrConfigurationInitializer(EnodebConfigurationPostProcessor):
+    def postprocess(self, mconfig: Any, service_cfg: Any, desired_cfg: EnodebConfiguration) -> None:
+
+        desired_cfg.delete_parameter(ParameterName.ADMIN_STATE)
diff --git a/devices/baicells_qafb.py b/devices/baicells_qafb.py
new file mode 100644
index 0000000..0f2e9cd
--- /dev/null
+++ b/devices/baicells_qafb.py
@@ -0,0 +1,513 @@
+"""
+Copyright 2020 The Magma Authors.
+
+This source code is licensed under the BSD-style license found in the
+LICENSE file in the root directory of this source tree.
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+"""
+
+from typing import Any, Callable, Dict, List, Optional, Type
+
+from common.service import MagmaService
+from data_models import transform_for_enb, transform_for_magma
+from data_models.data_model import DataModel, TrParam
+from data_models.data_model_parameters import (
+    ParameterName,
+    TrParameterType,
+)
+from device_config.configuration_init import build_desired_config
+from device_config.enodeb_config_postprocessor import (
+    EnodebConfigurationPostProcessor,
+)
+from device_config.enodeb_configuration import EnodebConfiguration
+from devices.device_utils import EnodebDeviceName
+from logger import EnodebdLogger as logger
+from state_machines.acs_state_utils import (
+    get_all_objects_to_add,
+    get_all_objects_to_delete,
+    get_all_param_values_to_set,
+    get_params_to_get,
+    parse_get_parameter_values_response,
+)
+from state_machines.enb_acs import EnodebAcsStateMachine
+from state_machines.enb_acs_impl import BasicEnodebAcsStateMachine
+from state_machines.enb_acs_states import (
+    AcsMsgAndTransition,
+    AcsReadMsgResult,
+    AddObjectsState,
+    DeleteObjectsState,
+    EnbSendRebootState,
+    EndSessionState,
+    EnodebAcsState,
+    ErrorState,
+    GetParametersState,
+    GetRPCMethodsState,
+    SendGetTransientParametersState,
+    SetParameterValuesState,
+    WaitEmptyMessageState,
+    WaitGetParametersState,
+    WaitInformMRebootState,
+    WaitInformState,
+    WaitRebootResponseState,
+    WaitSetParameterValuesState,
+)
+from tr069 import models
+
+
+class BaicellsQAFBHandler(BasicEnodebAcsStateMachine):
+    def __init__(
+            self,
+            service: MagmaService,
+    ) -> None:
+        self._state_map = {}
+        super().__init__(service=service, use_param_key=False)
+
+    def reboot_asap(self) -> None:
+        self.transition('reboot')
+
+    def is_enodeb_connected(self) -> bool:
+        return not isinstance(self.state, WaitInformState)
+
+    def _init_state_map(self) -> None:
+        self._state_map = {
+            'wait_inform': WaitInformState(self, when_done='get_rpc_methods'),
+            'get_rpc_methods': GetRPCMethodsState(self, when_done='wait_empty', when_skip='get_transient_params'),
+            'wait_empty': WaitEmptyMessageState(self, when_done='get_transient_params'),
+            'get_transient_params': SendGetTransientParametersState(self, when_done='wait_get_transient_params'),
+            'wait_get_transient_params': BaicellsQafbWaitGetTransientParametersState(self, when_get='get_params', when_get_obj_params='get_obj_params', when_delete='delete_objs', when_add='add_objs', when_set='set_params', when_skip='end_session'),
+            'get_params': GetParametersState(self, when_done='wait_get_params'),
+            'wait_get_params': WaitGetParametersState(self, when_done='get_obj_params'),
+            'get_obj_params': BaicellsQafbGetObjectParametersState(self, when_delete='delete_objs', when_add='add_objs', when_set='set_params', when_skip='end_session'),
+            'delete_objs': DeleteObjectsState(self, when_add='add_objs', when_skip='set_params'),
+            'add_objs': AddObjectsState(self, when_done='set_params'),
+            'set_params': SetParameterValuesState(self, when_done='wait_set_params'),
+            'wait_set_params': WaitSetParameterValuesState(self, when_done='check_get_params', when_apply_invasive='check_get_params'),
+            'check_get_params': GetParametersState(self, when_done='check_wait_get_params', request_all_params=True),
+            'check_wait_get_params': WaitGetParametersState(self, when_done='end_session'),
+            'end_session': EndSessionState(self),
+            # These states are only entered through manual user intervention
+            'reboot': EnbSendRebootState(self, when_done='wait_reboot'),
+            'wait_reboot': WaitRebootResponseState(self, when_done='wait_post_reboot_inform'),
+            'wait_post_reboot_inform': WaitInformMRebootState(self, when_done='wait_empty', when_timeout='wait_inform'),
+            # The states below are entered when an unexpected message type is
+            # received
+            'unexpected_fault': ErrorState(self, inform_transition_target='wait_inform'),
+        }
+
+    @property
+    def device_name(self) -> str:
+        return EnodebDeviceName.BAICELLS_QAFB
+
+    @property
+    def data_model_class(self) -> Type[DataModel]:
+        return BaicellsQAFBTrDataModel
+
+    @property
+    def config_postprocessor(self) -> EnodebConfigurationPostProcessor:
+        return BaicellsQAFBTrConfigurationInitializer()
+
+    @property
+    def state_map(self) -> Dict[str, EnodebAcsState]:
+        return self._state_map
+
+    @property
+    def disconnected_state_name(self) -> str:
+        return 'wait_inform'
+
+    @property
+    def unexpected_fault_state_name(self) -> str:
+        return 'unexpected_fault'
+
+
+def _get_object_params_to_get(
+    device_cfg: EnodebConfiguration,
+    data_model: DataModel,
+) -> List[ParameterName]:
+    """
+    Returns a list of parameter names for object parameters we don't know the
+    current value of.
+
+    Since there is no parameter for tracking the number of PLMNs, then we
+    make the assumption that if any PLMN object exists, then we've already
+    fetched the object parameter values.
+    """
+    if device_cfg.has_object(ParameterName.PLMN_N % 1):
+        return []
+
+    names = []
+    num_plmns = data_model.get_num_plmns()
+    obj_to_params = data_model.get_numbered_param_names()
+    for i in range(1, num_plmns + 1):
+        obj_name = ParameterName.PLMN_N % i
+        desired = obj_to_params[obj_name]
+        names = names + desired
+    return names
+
+
+class BaicellsQafbWaitGetTransientParametersState(EnodebAcsState):
+    """
+    Periodically read eNodeB status. Note: keep frequency low to avoid
+    backing up large numbers of read operations if enodebd is busy
+    """
+
+    def __init__(
+            self,
+            acs: EnodebAcsStateMachine,
+            when_get: str,
+            when_get_obj_params: str,
+            when_delete: str,
+            when_add: str,
+            when_set: str,
+            when_skip: str,
+    ):
+        super().__init__()
+        self.acs = acs
+        self.done_transition = when_get
+        self.get_obj_params_transition = when_get_obj_params
+        self.rm_obj_transition = when_delete
+        self.add_obj_transition = when_add
+        self.set_transition = when_set
+        self.skip_transition = when_skip
+
+    def read_msg(self, message: Any) -> AcsReadMsgResult:
+        """ Process GetParameterValuesResponse """
+        if not isinstance(message, models.GetParameterValuesResponse):
+            return AcsReadMsgResult(False, None)
+        # Current values of the fetched parameters
+        name_to_val = parse_get_parameter_values_response(
+            self.acs.data_model,
+            message,
+        )
+        logger.debug('Received Parameters: %s', str(name_to_val))
+
+        # Update device configuration
+        for name in name_to_val:
+            magma_value = \
+                self.acs.data_model.transform_for_magma(name, name_to_val[name])
+            self.acs.device_cfg.set_parameter(name, magma_value)
+
+        return AcsReadMsgResult(True, self.get_next_state())
+
+    def get_next_state(self) -> str:
+        should_get_params = \
+            len(
+                get_params_to_get(
+                    self.acs.device_cfg,
+                    self.acs.data_model,
+                ),
+            ) > 0
+        if should_get_params:
+            return self.done_transition
+        should_get_obj_params = \
+            len(
+                _get_object_params_to_get(
+                    self.acs.device_cfg,
+                    self.acs.data_model,
+                ),
+            ) > 0
+        if should_get_obj_params:
+            return self.get_obj_params_transition
+        elif len(
+            get_all_objects_to_delete(
+                self.acs.desired_cfg,
+                self.acs.device_cfg,
+            ),
+        ) > 0:
+            return self.rm_obj_transition
+        elif len(
+            get_all_objects_to_add(
+                self.acs.desired_cfg,
+                self.acs.device_cfg,
+            ),
+        ) > 0:
+            return self.add_obj_transition
+        return self.skip_transition
+
+    def state_description(self) -> str:
+        return 'Getting transient read-only parameters'
+
+
+class BaicellsQafbGetObjectParametersState(EnodebAcsState):
+    """
+    Get information on parameters belonging to objects that can be added or
+    removed from the configuration.
+
+    Baicells QAFB will report a parameter value as None if it does not exist
+    in the data model, rather than replying with a Fault message like most
+    eNB devices.
+    """
+
+    def __init__(
+            self,
+            acs: EnodebAcsStateMachine,
+            when_delete: str,
+            when_add: str,
+            when_set: str,
+            when_skip: str,
+    ):
+        super().__init__()
+        self.acs = acs
+        self.rm_obj_transition = when_delete
+        self.add_obj_transition = when_add
+        self.set_params_transition = when_set
+        self.skip_transition = when_skip
+
+    def get_msg(self, message: Any) -> AcsMsgAndTransition:
+        """ Respond with GetParameterValuesRequest """
+        names = _get_object_params_to_get(
+            self.acs.device_cfg,
+            self.acs.data_model,
+        )
+
+        # Generate the request
+        request = models.GetParameterValues()
+        request.ParameterNames = models.ParameterNames()
+        request.ParameterNames.arrayType = 'xsd:string[%d]' \
+                                           % len(names)
+        request.ParameterNames.string = []
+        for name in names:
+            path = self.acs.data_model.get_parameter(name).path
+            request.ParameterNames.string.append(path)
+
+        return AcsMsgAndTransition(request, None)
+
+    def read_msg(self, message: Any) -> AcsReadMsgResult:
+        """
+        Process GetParameterValuesResponse
+
+        Object parameters that have a reported value of None indicate that
+        the object is not in the eNB's configuration. Most eNB devices will
+        reply with a Fault message if we try to get values of parameters that
+        don't exist on the data model, so this is an idiosyncrasy of Baicells
+        QAFB.
+        """
+        if not isinstance(message, models.GetParameterValuesResponse):
+            return AcsReadMsgResult(False, None)
+
+        path_to_val = {}
+        for param_value_struct in message.ParameterList.ParameterValueStruct:
+            path_to_val[param_value_struct.Name] = \
+                param_value_struct.Value.Data
+
+        logger.debug('Received object parameters: %s', str(path_to_val))
+
+        num_plmns = self.acs.data_model.get_num_plmns()
+        for i in range(1, num_plmns + 1):
+            obj_name = ParameterName.PLMN_N % i
+            obj_to_params = self.acs.data_model.get_numbered_param_names()
+            param_name_list = obj_to_params[obj_name]
+            for name in param_name_list:
+                path = self.acs.data_model.get_parameter(name).path
+                if path in path_to_val:
+                    value = path_to_val[path]
+                    if value is None:
+                        continue
+                    if obj_name not in self.acs.device_cfg.get_object_names():
+                        self.acs.device_cfg.add_object(obj_name)
+                    magma_value = \
+                        self.acs.data_model.transform_for_magma(name, value)
+                    self.acs.device_cfg.set_parameter_for_object(
+                        name,
+                        magma_value,
+                        obj_name,
+                    )
+
+        # Now we have enough information to build the desired configuration
+        if self.acs.desired_cfg is None:
+            self.acs.desired_cfg = build_desired_config(
+                self.acs.mconfig,
+                self.acs.service_config,
+                self.acs.device_cfg,
+                self.acs.data_model,
+                self.acs.config_postprocessor,
+            )
+
+        if len(
+            get_all_objects_to_delete(
+                self.acs.desired_cfg,
+                self.acs.device_cfg,
+            ),
+        ) > 0:
+            return AcsReadMsgResult(True, self.rm_obj_transition)
+        elif len(
+            get_all_objects_to_add(
+                self.acs.desired_cfg,
+                self.acs.device_cfg,
+            ),
+        ) > 0:
+            return AcsReadMsgResult(True, self.add_obj_transition)
+        elif len(
+            get_all_param_values_to_set(
+                self.acs.desired_cfg,
+                self.acs.device_cfg,
+                self.acs.data_model,
+            ),
+        ) > 0:
+            return AcsReadMsgResult(True, self.set_params_transition)
+        return AcsReadMsgResult(True, self.skip_transition)
+
+    def state_description(self) -> str:
+        return 'Getting object parameters'
+
+
+class BaicellsQAFBTrDataModel(DataModel):
+    """
+    Class to represent relevant data model parameters from TR-196/TR-098.
+    This class is effectively read-only.
+
+    This model specifically targets Qualcomm-based BaiCells units running
+    QAFB firmware.
+
+    These models have these idiosyncrasies (on account of running TR098):
+
+    - Parameter content root is different (InternetGatewayDevice)
+    - GetParameter queries with a wildcard e.g. InternetGatewayDevice. do
+      not respond with the full tree (we have to query all parameters)
+    - MME status is not exposed - we assume the MME is connected if
+      the eNodeB is transmitting (OpState=true)
+    - Parameters such as band capability/duplex config
+      are rooted under `boardconf.` and not the device config root
+    - Parameters like Admin state, CellReservedForOperatorUse,
+      Duplex mode, DL bandwidth and Band capability have different
+      formats from Intel-based Baicells units, necessitating,
+      formatting before configuration and transforming values
+      read from eNodeB state.
+    - Num PLMNs is not reported by these units
+    """
+    # Mapping of TR parameter paths to aliases
+    DEVICE_PATH = 'InternetGatewayDevice.'
+    FAPSERVICE_PATH = DEVICE_PATH + 'Services.FAPService.1.'
+    EEPROM_PATH = 'boardconf.status.eepromInfo.'
+    PARAMETERS = {
+        # Top-level objects
+        ParameterName.DEVICE: TrParam(DEVICE_PATH, True, TrParameterType.OBJECT, False),
+        ParameterName.FAP_SERVICE: TrParam(FAPSERVICE_PATH, True, TrParameterType.OBJECT, False),
+
+        # Qualcomm units do not expose MME_Status (We assume that the eNB is broadcasting state is connected to the MME)
+        ParameterName.MME_STATUS: TrParam(FAPSERVICE_PATH + 'CellConfig.1.LTE.X_QUALCOMM_FAPControl.OpState', True, TrParameterType.BOOLEAN, False),
+        ParameterName.GPS_LAT: TrParam(DEVICE_PATH + 'FAP.GPS.latitude', True, TrParameterType.STRING, False),
+        ParameterName.GPS_LONG: TrParam(DEVICE_PATH + 'FAP.GPS.longitude', True, TrParameterType.STRING, False),
+        ParameterName.SW_VERSION: TrParam(DEVICE_PATH + 'DeviceInfo.SoftwareVersion', True, TrParameterType.STRING, False),
+        ParameterName.SERIAL_NUMBER: TrParam(DEVICE_PATH + 'DeviceInfo.SerialNumber', True, TrParameterType.STRING, False),
+
+        # Capabilities
+        ParameterName.DUPLEX_MODE_CAPABILITY: TrParam(EEPROM_PATH + 'div_multiple', True, TrParameterType.STRING, False),
+        ParameterName.BAND_CAPABILITY: TrParam(EEPROM_PATH + 'work_mode', True, TrParameterType.STRING, False),
+
+        # RF-related parameters
+        ParameterName.EARFCNDL: TrParam(FAPSERVICE_PATH + 'CellConfig.1.LTE.RAN.RF.EARFCNDL', True, TrParameterType.INT, False),
+        ParameterName.PCI: TrParam(FAPSERVICE_PATH + 'CellConfig.1.LTE.RAN.RF.PhyCellID', True, TrParameterType.INT, False),
+        ParameterName.DL_BANDWIDTH: TrParam(DEVICE_PATH + 'Services.RfConfig.1.RfCarrierCommon.carrierBwMhz', True, TrParameterType.INT, False),
+        ParameterName.SUBFRAME_ASSIGNMENT: TrParam(FAPSERVICE_PATH + 'CellConfig.1.LTE.RAN.PHY.TDDFrame.SubFrameAssignment', True, 'bool', False),
+        ParameterName.SPECIAL_SUBFRAME_PATTERN: TrParam(FAPSERVICE_PATH + 'CellConfig.1.LTE.RAN.PHY.TDDFrame.SpecialSubframePatterns', True, TrParameterType.INT, False),
+        ParameterName.CELL_ID: TrParam(FAPSERVICE_PATH + 'CellConfig.1.LTE.RAN.Common.CellIdentity', True, TrParameterType.UNSIGNED_INT, False),
+
+        # Other LTE parameters
+        ParameterName.ADMIN_STATE: TrParam(FAPSERVICE_PATH + 'CellConfig.1.LTE.X_QUALCOMM_FAPControl.AdminState', False, TrParameterType.STRING, False),
+        ParameterName.OP_STATE: TrParam(FAPSERVICE_PATH + 'CellConfig.1.LTE.X_QUALCOMM_FAPControl.OpState', True, TrParameterType.BOOLEAN, False),
+        ParameterName.RF_TX_STATUS: TrParam(FAPSERVICE_PATH + 'CellConfig.1.LTE.X_QUALCOMM_FAPControl.OpState', True, TrParameterType.BOOLEAN, False),
+
+        # Core network parameters
+        ParameterName.MME_IP: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.Gateway.S1SigLinkServerList', True, TrParameterType.STRING, False),
+        ParameterName.MME_PORT: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.Gateway.S1SigLinkPort', True, TrParameterType.INT, False),
+        # This parameter is standard but doesn't exist
+        # ParameterName.NUM_PLMNS: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNListNumberOfEntries', True, TrParameterType.INT, False),
+        ParameterName.TAC: TrParam(FAPSERVICE_PATH + 'CellConfig.1.LTE.EPC.TAC', True, TrParameterType.INT, False),
+        ParameterName.IP_SEC_ENABLE: TrParam('boardconf.ipsec.ipsecConfig.onBoot', False, TrParameterType.BOOLEAN, False),
+
+        # Management server parameters
+        ParameterName.PERIODIC_INFORM_ENABLE: TrParam(DEVICE_PATH + 'ManagementServer.PeriodicInformEnable', False, TrParameterType.BOOLEAN, False),
+        ParameterName.PERIODIC_INFORM_INTERVAL: TrParam(DEVICE_PATH + 'ManagementServer.PeriodicInformInterval', False, TrParameterType.INT, False),
+
+        # Performance management parameters
+        ParameterName.PERF_MGMT_ENABLE: TrParam(FAPSERVICE_PATH + 'CellConfig.1.X_QUALCOMM_PerfMgmt.Config.Enable', False, TrParameterType.BOOLEAN, False),
+        ParameterName.PERF_MGMT_UPLOAD_INTERVAL: TrParam(DEVICE_PATH + 'FAP.PerfMgmt.Config.PeriodicUploadInterval', False, TrParameterType.INT, False),
+        ParameterName.PERF_MGMT_UPLOAD_URL: TrParam(DEVICE_PATH + 'FAP.PerfMgmt.Config.URL', False, TrParameterType.STRING, False),
+    }
+
+    NUM_PLMNS_IN_CONFIG = 6
+    TRANSFORMS_FOR_ENB = {
+        ParameterName.CELL_BARRED: transform_for_enb.invert_cell_barred,
+    }
+    for i in range(1, NUM_PLMNS_IN_CONFIG + 1):
+        TRANSFORMS_FOR_ENB[ParameterName.PLMN_N_CELL_RESERVED % i] = transform_for_enb.cell_reserved
+        PARAMETERS[ParameterName.PLMN_N % i] = TrParam(FAPSERVICE_PATH + 'CellConfig.1.LTE.EPC.PLMNList.%d.' % i, True, TrParameterType.STRING, False)
+        PARAMETERS[ParameterName.PLMN_N_CELL_RESERVED % i] = TrParam(FAPSERVICE_PATH + 'CellConfig.1.LTE.EPC.PLMNList.%d.CellReservedForOperatorUse' % i, True, TrParameterType.STRING, False)
+        PARAMETERS[ParameterName.PLMN_N_ENABLE % i] = TrParam(FAPSERVICE_PATH + 'CellConfig.1.LTE.EPC.PLMNList.%d.Enable' % i, True, TrParameterType.BOOLEAN, False)
+        PARAMETERS[ParameterName.PLMN_N_PRIMARY % i] = TrParam(FAPSERVICE_PATH + 'CellConfig.1.LTE.EPC.PLMNList.%d.IsPrimary' % i, True, TrParameterType.BOOLEAN, False)
+        PARAMETERS[ParameterName.PLMN_N_PLMNID % i] = TrParam(FAPSERVICE_PATH + 'CellConfig.1.LTE.EPC.PLMNList.%d.PLMNID' % i, True, TrParameterType.STRING, False)
+
+    TRANSFORMS_FOR_ENB[ParameterName.ADMIN_STATE] = transform_for_enb.admin_state
+    TRANSFORMS_FOR_MAGMA = {
+        # We don't set these parameters
+        ParameterName.BAND_CAPABILITY: transform_for_magma.band_capability,
+        ParameterName.DUPLEX_MODE_CAPABILITY: transform_for_magma.duplex_mode,
+    }
+
+    @classmethod
+    def get_parameter(cls, param_name: ParameterName) -> Optional[TrParam]:
+        return cls.PARAMETERS.get(param_name)
+
+    @classmethod
+    def _get_magma_transforms(
+        cls,
+    ) -> Dict[ParameterName, Callable[[Any], Any]]:
+        return cls.TRANSFORMS_FOR_MAGMA
+
+    @classmethod
+    def _get_enb_transforms(cls) -> Dict[ParameterName, Callable[[Any], Any]]:
+        return cls.TRANSFORMS_FOR_ENB
+
+    @classmethod
+    def get_load_parameters(cls) -> List[ParameterName]:
+        """
+        Load all the parameters instead of a subset.
+        """
+        return list(cls.PARAMETERS.keys())
+
+    @classmethod
+    def get_num_plmns(cls) -> int:
+        return cls.NUM_PLMNS_IN_CONFIG
+
+    @classmethod
+    def get_parameter_names(cls) -> List[ParameterName]:
+        excluded_params = [
+            str(ParameterName.DEVICE),
+            str(ParameterName.FAP_SERVICE),
+        ]
+        names = list(
+            filter(
+                lambda x: (not str(x).startswith('PLMN'))
+                and (str(x) not in excluded_params),
+                cls.PARAMETERS.keys(),
+            ),
+        )
+        return names
+
+    @classmethod
+    def get_numbered_param_names(
+        cls,
+    ) -> Dict[ParameterName, List[ParameterName]]:
+        names = {}
+        for i in range(1, cls.NUM_PLMNS_IN_CONFIG + 1):
+            params = []
+            params.append(ParameterName.PLMN_N_CELL_RESERVED % i)
+            params.append(ParameterName.PLMN_N_ENABLE % i)
+            params.append(ParameterName.PLMN_N_PRIMARY % i)
+            params.append(ParameterName.PLMN_N_PLMNID % i)
+            names[ParameterName.PLMN_N % i] = params
+
+        return names
+
+
+class BaicellsQAFBTrConfigurationInitializer(EnodebConfigurationPostProcessor):
+    def postprocess(self, mconfig: Any, service_cfg: Any, desired_cfg: EnodebConfiguration) -> None:
+        # We don't set this parameter for this device, it should be
+        # auto-configured by the device.
+        desired_cfg.delete_parameter(ParameterName.ADMIN_STATE)
+        return
diff --git a/devices/baicells_rts.py b/devices/baicells_rts.py
new file mode 100644
index 0000000..9a2cafd
--- /dev/null
+++ b/devices/baicells_rts.py
@@ -0,0 +1,309 @@
+"""
+Copyright 2020 The Magma Authors.
+
+This source code is licensed under the BSD-style license found in the
+LICENSE file in the root directory of this source tree.
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+"""
+
+from typing import Any, Callable, Dict, List, Optional, Type
+
+from common.service import MagmaService
+from data_models import transform_for_enb, transform_for_magma
+from data_models.data_model import DataModel, TrParam
+from data_models.data_model_parameters import (
+    ParameterName,
+    TrParameterType,
+)
+from device_config.enodeb_config_postprocessor import (
+    EnodebConfigurationPostProcessor,
+)
+from device_config.enodeb_configuration import EnodebConfiguration
+from devices.device_utils import EnodebDeviceName
+from state_machines.enb_acs_impl import BasicEnodebAcsStateMachine
+from state_machines.enb_acs_states import (
+    AddObjectsState,
+    CheckOptionalParamsState,
+    DeleteObjectsState,
+    EnbSendRebootState,
+    EndSessionState,
+    EnodebAcsState,
+    ErrorState,
+    GetObjectParametersState,
+    GetParametersState,
+    SendGetTransientParametersState,
+    SetParameterValuesState,
+    WaitEmptyMessageState,
+    WaitGetObjectParametersState,
+    WaitGetParametersState,
+    WaitGetTransientParametersState,
+    WaitInformMRebootState,
+    WaitInformState,
+    WaitRebootResponseState,
+    WaitSetParameterValuesState,
+)
+
+
+class BaicellsRTSHandler(BasicEnodebAcsStateMachine):
+    def __init__(
+            self,
+            service: MagmaService,
+    ) -> None:
+        self._state_map = {}
+        super().__init__(service=service, use_param_key=False)
+
+    def reboot_asap(self) -> None:
+        self.transition('reboot')
+
+    def is_enodeb_connected(self) -> bool:
+        return not isinstance(self.state, WaitInformState)
+
+    def _init_state_map(self) -> None:
+        self._state_map = {
+            'wait_inform': WaitInformState(self, when_done='wait_empty', when_boot=None),
+            'wait_empty': WaitEmptyMessageState(self, when_done='get_transient_params', when_missing='check_optional_params'),
+            'check_optional_params': CheckOptionalParamsState(self, when_done='get_transient_params'),
+            'get_transient_params': SendGetTransientParametersState(self, when_done='wait_get_transient_params'),
+            'wait_get_transient_params': WaitGetTransientParametersState(self, when_get='get_params', when_get_obj_params='get_obj_params', when_delete='delete_objs', when_add='add_objs', when_set='set_params', when_skip='end_session'),
+            'get_params': GetParametersState(self, when_done='wait_get_params'),
+            'wait_get_params': WaitGetParametersState(self, when_done='get_obj_params'),
+            'get_obj_params': GetObjectParametersState(self, when_done='wait_get_obj_params'),
+            'wait_get_obj_params': WaitGetObjectParametersState(self, when_delete='delete_objs', when_add='add_objs', when_set='set_params', when_skip='end_session'),
+            'delete_objs': DeleteObjectsState(self, when_add='add_objs', when_skip='set_params'),
+            'add_objs': AddObjectsState(self, when_done='set_params'),
+            'set_params': SetParameterValuesState(self, when_done='wait_set_params'),
+            'wait_set_params': WaitSetParameterValuesState(self, when_done='check_get_params', when_apply_invasive='reboot'),
+            'check_get_params': GetParametersState(self, when_done='check_wait_get_params', request_all_params=True),
+            'check_wait_get_params': WaitGetParametersState(self, when_done='end_session'),
+            'end_session': EndSessionState(self),
+            'reboot': EnbSendRebootState(self, when_done='wait_reboot'),
+            'wait_reboot': WaitRebootResponseState(self, when_done='wait_post_reboot_inform'),
+            'wait_post_reboot_inform': WaitInformMRebootState(self, when_done='wait_empty_post_reboot', when_timeout='wait_inform_post_reboot'),
+            'wait_inform_post_reboot': WaitInformState(self, when_done='wait_empty_post_reboot', when_boot=None),
+            'wait_empty_post_reboot': WaitEmptyMessageState(self, when_done='get_transient_params', when_missing='check_optional_params'),
+            # The states below are entered when an unexpected message type is
+            # received
+            'unexpected_fault': ErrorState(self),
+        }
+
+    @property
+    def device_name(self) -> str:
+        return EnodebDeviceName.BAICELLS_RTS
+
+    @property
+    def data_model_class(self) -> Type[DataModel]:
+        return BaicellsRTSTrDataModel
+
+    @property
+    def config_postprocessor(self) -> EnodebConfigurationPostProcessor:
+        return BaicellsRTSTrConfigurationInitializer()
+
+    @property
+    def state_map(self) -> Dict[str, EnodebAcsState]:
+        return self._state_map
+
+    @property
+    def disconnected_state_name(self) -> str:
+        return 'wait_inform'
+
+    @property
+    def unexpected_fault_state_name(self) -> str:
+        return 'unexpected_fault'
+
+
+class BaicellsRTSTrDataModel(DataModel):
+    """
+    Class to represent relevant data model parameters from TR-196/TR-098/TR-181.
+    This class is effectively read-only
+
+    This is for any version beginning with BaiBS_ or after
+    """
+    # Parameters to query when reading eNodeB config
+    LOAD_PARAMETERS = [ParameterName.DEVICE]
+    # Mapping of TR parameter paths to aliases
+    DEVICE_PATH = 'Device.'
+    FAPSERVICE_PATH = DEVICE_PATH + 'Services.FAPService.1.'
+    PARAMETERS = {
+        # Top-level objects
+        ParameterName.DEVICE: TrParam(DEVICE_PATH, True, TrParameterType.OBJECT, False),
+        ParameterName.FAP_SERVICE: TrParam(FAPSERVICE_PATH, True, TrParameterType.OBJECT, False),
+
+        # Device info parameters
+        ParameterName.GPS_STATUS: TrParam(DEVICE_PATH + 'DeviceInfo.X_BAICELLS_COM_GPS_Status', True, TrParameterType.BOOLEAN, False),
+        ParameterName.PTP_STATUS: TrParam(DEVICE_PATH + 'DeviceInfo.X_BAICELLS_COM_1588_Status', True, TrParameterType.BOOLEAN, False),
+        ParameterName.MME_STATUS: TrParam(DEVICE_PATH + 'DeviceInfo.X_BAICELLS_COM_MME_Status', True, TrParameterType.BOOLEAN, False),
+        ParameterName.REM_STATUS: TrParam(FAPSERVICE_PATH + 'REM.X_BAICELLS_COM_REM_Status', True, TrParameterType.BOOLEAN, False),
+        ParameterName.LOCAL_GATEWAY_ENABLE:
+            TrParam(DEVICE_PATH + 'DeviceInfo.X_BAICELLS_COM_LTE_LGW_Switch', False, TrParameterType.BOOLEAN, False),
+        # Tested Baicells devices were missing this parameter
+        ParameterName.GPS_ENABLE: TrParam(DEVICE_PATH + 'X_BAICELLS_COM_GpsSyncEnable', False, TrParameterType.BOOLEAN, True),
+        ParameterName.GPS_LAT: TrParam(DEVICE_PATH + 'FAP.GPS.LockedLatitude', True, TrParameterType.INT, True),
+        ParameterName.GPS_LONG: TrParam(DEVICE_PATH + 'FAP.GPS.LockedLongitude', True, TrParameterType.INT, True),
+        ParameterName.SW_VERSION: TrParam(DEVICE_PATH + 'DeviceInfo.SoftwareVersion', True, TrParameterType.STRING, False),
+        ParameterName.SERIAL_NUMBER: TrParam(DEVICE_PATH + 'DeviceInfo.SerialNumber', True, TrParameterType.STRING, False),
+
+        # Capabilities
+        ParameterName.DUPLEX_MODE_CAPABILITY: TrParam(
+            FAPSERVICE_PATH + 'Capabilities.LTE.DuplexMode', True, TrParameterType.STRING, False,
+        ),
+        ParameterName.BAND_CAPABILITY: TrParam(FAPSERVICE_PATH + 'Capabilities.LTE.BandsSupported', True, TrParameterType.STRING, False),
+
+        # RF-related parameters
+        ParameterName.EARFCNDL: TrParam(FAPSERVICE_PATH + 'X_BAICELLS_COM_LTE.EARFCNDLInUse', True, TrParameterType.INT, False),
+        ParameterName.EARFCNUL: TrParam(FAPSERVICE_PATH + 'X_BAICELLS_COM_LTE.EARFCNULInUse', True, TrParameterType.INT, False),
+        ParameterName.BAND: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.FreqBandIndicator', True, TrParameterType.INT, False),
+        ParameterName.PCI: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.PhyCellID', False, TrParameterType.INT, False),
+        ParameterName.DL_BANDWIDTH: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.DLBandwidth', True, TrParameterType.STRING, False),
+        ParameterName.UL_BANDWIDTH: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.ULBandwidth', True, TrParameterType.STRING, False),
+        ParameterName.SUBFRAME_ASSIGNMENT: TrParam(
+            FAPSERVICE_PATH
+            + 'CellConfig.LTE.RAN.PHY.TDDFrame.SubFrameAssignment', True, TrParameterType.INT, False,
+        ),
+        ParameterName.SPECIAL_SUBFRAME_PATTERN: TrParam(
+            FAPSERVICE_PATH
+            + 'CellConfig.LTE.RAN.PHY.TDDFrame.SpecialSubframePatterns', True, TrParameterType.INT, False,
+        ),
+        ParameterName.CELL_ID: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.Common.CellIdentity', True, TrParameterType.UNSIGNED_INT, False),
+
+        # Other LTE parameters
+        ParameterName.ADMIN_STATE: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.AdminState', False, TrParameterType.BOOLEAN, False),
+        ParameterName.OP_STATE: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.OpState', True, TrParameterType.BOOLEAN, False),
+        ParameterName.RF_TX_STATUS: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.RFTxStatus', True, TrParameterType.BOOLEAN, False),
+
+        # RAN parameters
+        ParameterName.CELL_RESERVED: TrParam(
+            FAPSERVICE_PATH
+            + 'CellConfig.LTE.RAN.CellRestriction.CellReservedForOperatorUse', True, TrParameterType.BOOLEAN, False,
+        ),
+        ParameterName.CELL_BARRED: TrParam(
+            FAPSERVICE_PATH
+            + 'CellConfig.LTE.RAN.CellRestriction.CellBarred', True, TrParameterType.BOOLEAN, False,
+        ),
+
+        # Core network parameters
+        ParameterName.MME_IP: TrParam(
+            FAPSERVICE_PATH + 'FAPControl.LTE.Gateway.S1SigLinkServerList', True, TrParameterType.STRING, False,
+        ),
+        ParameterName.MME_PORT: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.Gateway.S1SigLinkPort', True, TrParameterType.INT, False),
+        ParameterName.NUM_PLMNS: TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNListNumberOfEntries', True, TrParameterType.INT, False,
+        ),
+        ParameterName.PLMN: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.', True, TrParameterType.STRING, False),
+        # PLMN arrays are added below
+        ParameterName.TAC: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.TAC', True, TrParameterType.INT, False),
+        ParameterName.IP_SEC_ENABLE: TrParam(
+            DEVICE_PATH + 'Services.FAPService.Ipsec.IPSEC_ENABLE', False, TrParameterType.BOOLEAN, False,
+        ),
+        ParameterName.MME_POOL_ENABLE: TrParam(
+            FAPSERVICE_PATH
+            + 'FAPControl.LTE.Gateway.X_BAICELLS_COM_MmePool.Enable', True, TrParameterType.BOOLEAN, False,
+        ),
+
+        # Management server parameters
+        ParameterName.PERIODIC_INFORM_ENABLE:
+            TrParam(DEVICE_PATH + 'ManagementServer.PeriodicInformEnable', False, TrParameterType.BOOLEAN, False),
+        ParameterName.PERIODIC_INFORM_INTERVAL:
+            TrParam(DEVICE_PATH + 'ManagementServer.PeriodicInformInterval', False, TrParameterType.INT, False),
+
+        # Performance management parameters
+        ParameterName.PERF_MGMT_ENABLE: TrParam(
+            DEVICE_PATH + 'FAP.PerfMgmt.Config.1.Enable', False, TrParameterType.BOOLEAN, False,
+        ),
+        ParameterName.PERF_MGMT_UPLOAD_INTERVAL: TrParam(
+            DEVICE_PATH + 'FAP.PerfMgmt.Config.1.PeriodicUploadInterval', False, TrParameterType.INT, False,
+        ),
+        ParameterName.PERF_MGMT_UPLOAD_URL: TrParam(
+            DEVICE_PATH + 'FAP.PerfMgmt.Config.1.URL', False, TrParameterType.STRING, False,
+        ),
+
+    }
+
+    NUM_PLMNS_IN_CONFIG = 6
+    for i in range(1, NUM_PLMNS_IN_CONFIG + 1):
+        PARAMETERS[(ParameterName.PLMN_N) % i] = TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.' % i, True, TrParameterType.STRING, False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_CELL_RESERVED % i] = TrParam(
+            FAPSERVICE_PATH
+            + 'CellConfig.LTE.EPC.PLMNList.%d.CellReservedForOperatorUse' % i, True, TrParameterType.BOOLEAN, False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_ENABLE % i] = TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.Enable' % i, True, TrParameterType.BOOLEAN, False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_PRIMARY % i] = TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.IsPrimary' % i, True, TrParameterType.BOOLEAN, False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_PLMNID % i] = TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.PLMNID' % i, True, TrParameterType.STRING, False,
+        )
+
+    TRANSFORMS_FOR_ENB = {
+        ParameterName.DL_BANDWIDTH: transform_for_enb.bandwidth,
+        ParameterName.UL_BANDWIDTH: transform_for_enb.bandwidth,
+    }
+    TRANSFORMS_FOR_MAGMA = {
+        ParameterName.DL_BANDWIDTH: transform_for_magma.bandwidth,
+        ParameterName.UL_BANDWIDTH: transform_for_magma.bandwidth,
+        # We don't set GPS, so we don't need transform for enb
+        ParameterName.GPS_LAT: transform_for_magma.gps_tr181,
+        ParameterName.GPS_LONG: transform_for_magma.gps_tr181,
+    }
+
+    @classmethod
+    def get_parameter(cls, param_name: ParameterName) -> Optional[TrParam]:
+        return cls.PARAMETERS.get(param_name)
+
+    @classmethod
+    def _get_magma_transforms(
+            cls,
+    ) -> Dict[ParameterName, Callable[[Any], Any]]:
+        return cls.TRANSFORMS_FOR_MAGMA
+
+    @classmethod
+    def _get_enb_transforms(cls) -> Dict[ParameterName, Callable[[Any], Any]]:
+        return cls.TRANSFORMS_FOR_ENB
+
+    @classmethod
+    def get_load_parameters(cls) -> List[ParameterName]:
+        return cls.LOAD_PARAMETERS
+
+    @classmethod
+    def get_num_plmns(cls) -> int:
+        return cls.NUM_PLMNS_IN_CONFIG
+
+    @classmethod
+    def get_parameter_names(cls) -> List[ParameterName]:
+        excluded_params = [
+            str(ParameterName.DEVICE),
+            str(ParameterName.FAP_SERVICE),
+        ]
+        names = list(
+            filter(
+                lambda x: (not str(x).startswith('PLMN'))
+                and (str(x) not in excluded_params),
+                cls.PARAMETERS.keys(),
+            ),
+        )
+        return names
+
+    @classmethod
+    def get_numbered_param_names(cls) -> Dict[ParameterName, List[ParameterName]]:
+        names = {}
+        for i in range(1, cls.NUM_PLMNS_IN_CONFIG + 1):
+            params = []
+            params.append(ParameterName.PLMN_N_CELL_RESERVED % i)
+            params.append(ParameterName.PLMN_N_ENABLE % i)
+            params.append(ParameterName.PLMN_N_PRIMARY % i)
+            params.append(ParameterName.PLMN_N_PLMNID % i)
+            names[ParameterName.PLMN_N % i] = params
+        return names
+
+
+class BaicellsRTSTrConfigurationInitializer(EnodebConfigurationPostProcessor):
+    def postprocess(self, mconfig: Any, service_cfg: Any, desired_cfg: EnodebConfiguration) -> None:
+        desired_cfg.set_parameter(ParameterName.CELL_BARRED, False)
diff --git a/devices/device_map.py b/devices/device_map.py
new file mode 100644
index 0000000..198c4d3
--- /dev/null
+++ b/devices/device_map.py
@@ -0,0 +1,44 @@
+"""
+Copyright 2020 The Magma Authors.
+
+This source code is licensed under the BSD-style license found in the
+LICENSE file in the root directory of this source tree.
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+"""
+
+from typing import Type
+
+from devices.baicells import BaicellsHandler
+from devices.baicells_old import BaicellsOldHandler
+from devices.baicells_qafa import BaicellsQAFAHandler
+from devices.baicells_qafb import BaicellsQAFBHandler
+from devices.baicells_rts import BaicellsRTSHandler
+from devices.device_utils import EnodebDeviceName
+from devices.experimental.cavium import CaviumHandler
+from devices.freedomfi_one import FreedomFiOneHandler
+from state_machines.enb_acs import EnodebAcsStateMachine
+
+# This exists only to break a circular dependency. Otherwise there's no
+# point of having these names for the devices
+
+
+DEVICE_HANDLER_BY_NAME = {
+    EnodebDeviceName.BAICELLS: BaicellsHandler,
+    EnodebDeviceName.BAICELLS_OLD: BaicellsOldHandler,
+    EnodebDeviceName.BAICELLS_QAFA: BaicellsQAFAHandler,
+    EnodebDeviceName.BAICELLS_QAFB: BaicellsQAFBHandler,
+    EnodebDeviceName.BAICELLS_RTS: BaicellsRTSHandler,
+    EnodebDeviceName.CAVIUM: CaviumHandler,
+    EnodebDeviceName.FREEDOMFI_ONE: FreedomFiOneHandler,
+}
+
+
+def get_device_handler_from_name(
+    name: EnodebDeviceName,
+) -> Type[EnodebAcsStateMachine]:
+    return DEVICE_HANDLER_BY_NAME[name]
diff --git a/devices/device_utils.py b/devices/device_utils.py
new file mode 100644
index 0000000..3eb91cb
--- /dev/null
+++ b/devices/device_utils.py
@@ -0,0 +1,114 @@
+"""
+Copyright 2020 The Magma Authors.
+
+This source code is licensed under the BSD-style license found in the
+LICENSE file in the root directory of this source tree.
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+"""
+
+import re
+
+from exceptions import UnrecognizedEnodebError
+from logger import EnodebdLogger as logger
+
+
+class EnodebDeviceName:
+    """
+    This exists only to break a circular dependency. Otherwise there's no
+    point of having these names for the devices
+    """
+
+    BAICELLS = "Baicells"
+    BAICELLS_OLD = "Baicells Old"
+    BAICELLS_QAFA = "Baicells QAFA"
+    BAICELLS_QAFB = "Baicells QAFB"
+    BAICELLS_RTS = "Baicells RTS"
+    CAVIUM = "Cavium"
+    FREEDOMFI_ONE = "FREEDOMFI ONE"
+
+
+def get_device_name(device_oui: str, sw_version: str,) -> str:
+    """
+    Use the manufacturer organization unique identifier read during INFORM
+    to select the TR data model used for configuration and status reports
+
+    Qualcomm-based Baicells eNodeBs use a TR098-based model different
+    from the Intel units. The software version on the Qualcomm models
+    also further limits the model usable by that device.
+
+    Args:
+        device_oui: string, OUI representing device vendor
+        sw_version: string, firmware version of eNodeB device
+
+    Returns:
+        DataModel
+    """
+    if device_oui in {"34ED0B", "48BF74"}:
+        if sw_version.startswith("BaiBS_QAFB"):
+            return EnodebDeviceName.BAICELLS_QAFB
+        elif sw_version.startswith("BaiBS_QAFA"):
+            return EnodebDeviceName.BAICELLS_QAFA
+        elif sw_version.startswith("BaiStation_"):
+            # Note: to disable flag inversion completely (for all builds),
+            # set to BaiStation_V000R000C00B000SPC000
+            # Note: to force flag inversion always (for all builds),
+            # set to BaiStation_V999R999C99B999SPC999
+            invert_before_version = _parse_sw_version(
+                "BaiStation_V100R001C00B110SPC003"
+            )
+            if _parse_sw_version(sw_version) < invert_before_version:
+                return EnodebDeviceName.BAICELLS_OLD
+            return EnodebDeviceName.BAICELLS
+        elif sw_version.startswith("BaiBS_RTS_"):
+            return EnodebDeviceName.BAICELLS_RTS
+        elif sw_version.startswith("BaiBS_RTSH_"):
+            return EnodebDeviceName.BAICELLS_RTS
+        else:
+            raise UnrecognizedEnodebError(
+                "Device %s unsupported: Software (%s)" % (device_oui, sw_version),
+            )
+    elif device_oui in {"000FB7", "744D28"}:
+        return EnodebDeviceName.CAVIUM
+    elif device_oui == "000E8F":
+        return EnodebDeviceName.FREEDOMFI_ONE
+    else:
+        raise UnrecognizedEnodebError("Device %s unsupported" % device_oui)
+
+
+def _parse_sw_version(version_str):
+    """
+    Parse SW version string.
+    Expects format: BaiStation_V100R001C00B110SPC003
+    For the above version string, returns: [100, 1, 0, 110, 3]
+    Note: trailing characters (for dev builds) are ignored. Null is returned
+    for version strings that don't match the above format.
+    """
+    logger.debug("Got firmware version: %s", version_str)
+
+    version = re.findall(
+        r"BaiStation_V(\d{3})R(\d{3})C(\d{2})B(\d{3})SPC(\d{3})", version_str,
+    )
+    if not version:
+        return None
+    elif len(version) > 1:
+        logger.warning(
+            "SW version (%s) not formatted as expected", version_str,
+        )
+    version_int = []
+    for num in version[0]:
+        try:
+            version_int.append(int(num))
+        except ValueError:
+            logger.warning(
+                "SW version (%s) not formatted as expected", version_str,
+            )
+            return None
+
+    logger.debug("Parsed firmware version: %s", version_int)
+
+    return version_int
diff --git a/devices/experimental/cavium.py b/devices/experimental/cavium.py
new file mode 100644
index 0000000..c62a622
--- /dev/null
+++ b/devices/experimental/cavium.py
@@ -0,0 +1,491 @@
+"""
+Copyright 2020 The Magma Authors.
+
+This source code is licensed under the BSD-style license found in the
+LICENSE file in the root directory of this source tree.
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+"""
+
+from typing import Any, Callable, Dict, List, Optional, Type
+
+from common.service import MagmaService
+from data_models import transform_for_enb, transform_for_magma
+from data_models.data_model import DataModel, TrParam
+from data_models.data_model_parameters import (
+    ParameterName,
+    TrParameterType,
+)
+from device_config.enodeb_config_postprocessor import (
+    EnodebConfigurationPostProcessor,
+)
+from device_config.enodeb_configuration import EnodebConfiguration
+from devices.device_utils import EnodebDeviceName
+from exceptions import Tr069Error
+from logger import EnodebdLogger as logger
+from state_machines.acs_state_utils import (
+    get_all_objects_to_add,
+    get_all_objects_to_delete,
+)
+from state_machines.enb_acs import EnodebAcsStateMachine
+from state_machines.enb_acs_impl import BasicEnodebAcsStateMachine
+from state_machines.enb_acs_states import (
+    AcsMsgAndTransition,
+    AcsReadMsgResult,
+    AddObjectsState,
+    DeleteObjectsState,
+    EndSessionState,
+    EnodebAcsState,
+    ErrorState,
+    GetParametersState,
+    GetRPCMethodsState,
+    SendGetTransientParametersState,
+    SendRebootState,
+    SetParameterValuesNotAdminState,
+    WaitEmptyMessageState,
+    WaitGetObjectParametersState,
+    WaitGetParametersState,
+    WaitGetTransientParametersState,
+    WaitInformMRebootState,
+    WaitInformState,
+    WaitRebootResponseState,
+    WaitSetParameterValuesState,
+)
+from tr069 import models
+
+
+class CaviumHandler(BasicEnodebAcsStateMachine):
+    def __init__(
+            self,
+            service: MagmaService,
+    ) -> None:
+        self._state_map = {}
+        super().__init__(service=service, use_param_key=False)
+
+    def reboot_asap(self) -> None:
+        self.transition('reboot')
+
+    def is_enodeb_connected(self) -> bool:
+        return not isinstance(self.state, WaitInformState)
+
+    def _init_state_map(self) -> None:
+        self._state_map = {
+            'wait_inform': WaitInformState(self, when_done='get_rpc_methods'),
+            'get_rpc_methods': GetRPCMethodsState(self, when_done='wait_empty', when_skip='get_transient_params'),
+            'wait_empty': WaitEmptyMessageState(self, when_done='get_transient_params'),
+            'get_transient_params': SendGetTransientParametersState(self, when_done='wait_get_transient_params'),
+            'wait_get_transient_params': WaitGetTransientParametersState(self, when_get='get_params', when_get_obj_params='get_obj_params', when_delete='delete_objs', when_add='add_objs', when_set='set_params', when_skip='end_session'),
+            'get_params': GetParametersState(self, when_done='wait_get_params'),
+            'wait_get_params': WaitGetParametersState(self, when_done='get_obj_params'),
+            'get_obj_params': CaviumGetObjectParametersState(self, when_done='wait_get_obj_params'),
+            'wait_get_obj_params': CaviumWaitGetObjectParametersState(self, when_edit='disable_admin', when_skip='get_transient_params'),
+            'disable_admin': CaviumDisableAdminEnableState(self, admin_value=False, when_done='wait_disable_admin'),
+            'wait_disable_admin': CaviumWaitDisableAdminEnableState(self, admin_value=False, when_add='add_objs', when_delete='delete_objs', when_done='set_params'),
+            'delete_objs': DeleteObjectsState(self, when_add='add_objs', when_skip='set_params'),
+            'add_objs': AddObjectsState(self, when_done='set_params'),
+            'set_params': SetParameterValuesNotAdminState(self, when_done='wait_set_params'),
+            'wait_set_params': WaitSetParameterValuesState(self, when_done='enable_admin', when_apply_invasive='enable_admin'),
+            'enable_admin': CaviumDisableAdminEnableState(self, admin_value=True, when_done='wait_enable_admin'),
+            'wait_enable_admin': CaviumWaitDisableAdminEnableState(self, admin_value=True, when_done='check_get_params', when_add='check_get_params', when_delete='check_get_params'),
+            'check_get_params': GetParametersState(self, when_done='check_wait_get_params', request_all_params=True),
+            'check_wait_get_params': WaitGetParametersState(self, when_done='end_session'),
+            'end_session': EndSessionState(self),
+            # Below states only entered through manual user intervention
+            'reboot': SendRebootState(self, when_done='wait_reboot'),
+            'wait_reboot': WaitRebootResponseState(self, when_done='wait_post_reboot_inform'),
+            'wait_post_reboot_inform': WaitInformMRebootState(self, when_done='wait_reboot_delay', when_timeout='wait_inform'),
+            # The states below are entered when an unexpected message type is
+            # received
+            'unexpected_fault': ErrorState(self, inform_transition_target='wait_inform'),
+        }
+
+    @property
+    def device_name(self) -> str:
+        return EnodebDeviceName.CAVIUM
+
+    @property
+    def data_model_class(self) -> Type[DataModel]:
+        return CaviumTrDataModel
+
+    @property
+    def config_postprocessor(self) -> EnodebConfigurationPostProcessor:
+        return CaviumTrConfigurationInitializer()
+
+    @property
+    def state_map(self) -> Dict[str, EnodebAcsState]:
+        return self._state_map
+
+    @property
+    def disconnected_state_name(self) -> str:
+        return 'wait_inform'
+
+    @property
+    def unexpected_fault_state_name(self) -> str:
+        return 'unexpected_fault'
+
+
+class CaviumGetObjectParametersState(EnodebAcsState):
+    """
+    When booted, the PLMN list is empty so we cannot get individual
+    object parameters. Instead, get the parent object PLMN_LIST
+    which will include any children if they exist.
+    """
+
+    def __init__(self, acs: EnodebAcsStateMachine, when_done: str):
+        super().__init__()
+        self.acs = acs
+        self.done_transition = when_done
+
+    def get_msg(self, message: Any) -> AcsMsgAndTransition:
+        """ Respond with GetParameterValuesRequest """
+        names = [ParameterName.PLMN_LIST]
+
+        # Generate the request
+        request = models.GetParameterValues()
+        request.ParameterNames = models.ParameterNames()
+        request.ParameterNames.arrayType = 'xsd:string[%d]' \
+                                           % len(names)
+        request.ParameterNames.string = []
+        for name in names:
+            path = self.acs.data_model.get_parameter(name).path
+            request.ParameterNames.string.append(path)
+
+        return AcsMsgAndTransition(request, self.done_transition)
+
+    def state_description(self) -> str:
+        return 'Getting object parameters'
+
+
+class CaviumWaitGetObjectParametersState(WaitGetObjectParametersState):
+    def __init__(
+        self,
+        acs: EnodebAcsStateMachine,
+        when_edit: str,
+        when_skip: str,
+    ):
+        super().__init__(
+            acs=acs,
+            when_add=when_edit,
+            when_delete=when_edit,
+            when_set=when_edit,
+            when_skip=when_skip,
+        )
+
+
+class CaviumDisableAdminEnableState(EnodebAcsState):
+    """
+    Cavium requires that we disable 'Admin Enable' before configuring
+    most parameters
+    """
+
+    def __init__(self, acs: EnodebAcsStateMachine, admin_value: bool, when_done: str):
+        super().__init__()
+        self.acs = acs
+        self.admin_value = admin_value
+        self.done_transition = when_done
+
+    def read_msg(self, message: Any) -> AcsReadMsgResult:
+        if not isinstance(message, models.DummyInput):
+            return AcsReadMsgResult(False, None)
+        return AcsReadMsgResult(True, None)
+
+    def get_msg(self, message: Any) -> AcsMsgAndTransition:
+        """
+        Returns:
+            A SetParameterValueRequest for setting 'Admin Enable' to False
+        """
+        param_name = ParameterName.ADMIN_STATE
+        # if we want the cell to be down don't force it up
+        desired_admin_value = \
+                self.acs.desired_cfg.get_parameter(param_name) \
+                and self.admin_value
+        admin_value = \
+                self.acs.data_model.transform_for_enb(
+                    param_name,
+                    desired_admin_value,
+                )
+        admin_path = self.acs.data_model.get_parameter(param_name).path
+        param_values = {admin_path: admin_value}
+
+        request = models.SetParameterValues()
+        request.ParameterList = models.ParameterValueList()
+        request.ParameterList.arrayType = 'cwmp:ParameterValueStruct[%d]' \
+                                          % len(param_values)
+
+        name_value = models.ParameterValueStruct()
+        name_value.Name = admin_path
+        name_value.Value = models.anySimpleType()
+        name_value.Value.type = 'xsd:string'
+        name_value.Value.Data = str(admin_value)
+        request.ParameterList.ParameterValueStruct = [name_value]
+
+        return AcsMsgAndTransition(request, self.done_transition)
+
+    def state_description(self) -> str:
+        return 'Disabling admin_enable (Cavium only)'
+
+
+class CaviumWaitDisableAdminEnableState(EnodebAcsState):
+    def __init__(
+            self,
+            acs: EnodebAcsStateMachine,
+            admin_value: bool,
+            when_done: str,
+            when_add: str,
+            when_delete: str,
+    ):
+        super().__init__()
+        self.acs = acs
+        self.done_transition = when_done
+        self.add_obj_transition = when_add
+        self.del_obj_transition = when_delete
+        self.admin_value = admin_value
+
+    def read_msg(self, message: Any) -> Optional[str]:
+        if type(message) == models.Fault:
+            logger.error('Received Fault in response to SetParameterValues')
+            if message.SetParameterValuesFault is not None:
+                for fault in message.SetParameterValuesFault:
+                    logger.error(
+                        'SetParameterValuesFault Param: %s, Code: %s, String: %s',
+                        fault.ParameterName, fault.FaultCode, fault.FaultString,
+                    )
+            raise Tr069Error(
+                'Received Fault in response to SetParameterValues '
+                '(faultstring = %s)' % message.FaultString,
+            )
+        elif not isinstance(message, models.SetParameterValuesResponse):
+            return AcsReadMsgResult(False, None)
+        if message.Status != 0:
+            raise Tr069Error(
+                'Received SetParameterValuesResponse with '
+                'Status=%d' % message.Status,
+            )
+        param_name = ParameterName.ADMIN_STATE
+        desired_admin_value = \
+                self.acs.desired_cfg.get_parameter(param_name) \
+                and self.admin_value
+        magma_value = \
+                self.acs.data_model.transform_for_magma(
+                    param_name,
+                    desired_admin_value,
+                )
+        self.acs.device_cfg.set_parameter(param_name, magma_value)
+
+        if len(
+            get_all_objects_to_delete(
+                self.acs.desired_cfg,
+                self.acs.device_cfg,
+            ),
+        ) > 0:
+            return AcsReadMsgResult(True, self.del_obj_transition)
+        elif len(
+            get_all_objects_to_add(
+                self.acs.desired_cfg,
+                self.acs.device_cfg,
+            ),
+        ) > 0:
+            return AcsReadMsgResult(True, self.add_obj_transition)
+        else:
+            return AcsReadMsgResult(True, self.done_transition)
+
+    def state_description(self) -> str:
+        return 'Disabling admin_enable (Cavium only)'
+
+
+class CaviumTrDataModel(DataModel):
+    """
+    Class to represent relevant data model parameters from TR-196/TR-098/TR-181.
+    This class is effectively read-only
+    """
+    # Mapping of TR parameter paths to aliases
+    DEVICE_PATH = 'Device.'
+    FAPSERVICE_PATH = DEVICE_PATH + 'Services.FAPService.1.'
+    PARAMETERS = {
+        # Top-level objects
+        ParameterName.DEVICE: TrParam(DEVICE_PATH, True, TrParameterType.OBJECT, False),
+        ParameterName.FAP_SERVICE: TrParam(FAPSERVICE_PATH, True, TrParameterType.OBJECT, False),
+
+        # Device info parameters
+        ParameterName.GPS_STATUS: TrParam(DEVICE_PATH + 'FAP.GPS.ContinuousGPSStatus.GotFix', True, TrParameterType.BOOLEAN, False),
+        ParameterName.GPS_LAT: TrParam(DEVICE_PATH + 'FAP.GPS.LockedLatitude', True, TrParameterType.INT, False),
+        ParameterName.GPS_LONG: TrParam(DEVICE_PATH + 'FAP.GPS.LockedLongitude', True, TrParameterType.INT, False),
+        ParameterName.SW_VERSION: TrParam(DEVICE_PATH + 'DeviceInfo.SoftwareVersion', True, TrParameterType.STRING, False),
+        ParameterName.SERIAL_NUMBER: TrParam(DEVICE_PATH + 'DeviceInfo.SerialNumber', True, TrParameterType.STRING, False),
+
+        # Capabilities
+        ParameterName.DUPLEX_MODE_CAPABILITY: TrParam(
+            FAPSERVICE_PATH + 'Capabilities.LTE.DuplexMode', True, TrParameterType.STRING, False,
+        ),
+        ParameterName.BAND_CAPABILITY: TrParam(FAPSERVICE_PATH + 'Capabilities.LTE.BandsSupported', True, TrParameterType.UNSIGNED_INT, False),
+
+        # RF-related parameters
+        ParameterName.EARFCNDL: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.EARFCNDL', True, TrParameterType.UNSIGNED_INT, False),
+        ParameterName.EARFCNUL: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.EARFCNUL', True, TrParameterType.UNSIGNED_INT, False),
+        ParameterName.BAND: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.FreqBandIndicator', True, TrParameterType.UNSIGNED_INT, False),
+        ParameterName.PCI: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.PhyCellID', True, TrParameterType.STRING, False),
+        ParameterName.DL_BANDWIDTH: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.DLBandwidth', True, TrParameterType.STRING, False),
+        ParameterName.UL_BANDWIDTH: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.RF.ULBandwidth', True, TrParameterType.STRING, False),
+        ParameterName.CELL_ID: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.RAN.Common.CellIdentity', True, TrParameterType.UNSIGNED_INT, False),
+
+        # Other LTE parameters
+        ParameterName.ADMIN_STATE: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.AdminState', False, TrParameterType.BOOLEAN, False),
+        ParameterName.OP_STATE: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.OpState', True, TrParameterType.BOOLEAN, False),
+        ParameterName.RF_TX_STATUS: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.RFTxStatus', True, TrParameterType.BOOLEAN, False),
+
+        # RAN parameters
+        ParameterName.CELL_RESERVED: TrParam(
+            FAPSERVICE_PATH
+            + 'CellConfig.LTE.RAN.CellRestriction.CellReservedForOperatorUse', True, TrParameterType.BOOLEAN, False,
+        ),
+        ParameterName.CELL_BARRED: TrParam(
+            FAPSERVICE_PATH
+            + 'CellConfig.LTE.RAN.CellRestriction.CellBarred', True, TrParameterType.BOOLEAN, False,
+        ),
+
+        # Core network parameters
+        ParameterName.MME_IP: TrParam(
+            FAPSERVICE_PATH + 'FAPControl.LTE.Gateway.S1SigLinkServerList', True, TrParameterType.STRING, False,
+        ),
+        ParameterName.MME_PORT: TrParam(FAPSERVICE_PATH + 'FAPControl.LTE.Gateway.S1SigLinkPort', True, TrParameterType.UNSIGNED_INT, False),
+        ParameterName.NUM_PLMNS: TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNListNumberOfEntries', True, TrParameterType.UNSIGNED_INT, False,
+        ),
+        ParameterName.PLMN: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.', True, TrParameterType.OBJECT, False),
+        # PLMN arrays are added below
+        ParameterName.TAC: TrParam(FAPSERVICE_PATH + 'CellConfig.LTE.EPC.TAC', True, TrParameterType.UNSIGNED_INT, False),
+        ParameterName.IP_SEC_ENABLE: TrParam(
+            DEVICE_PATH + 'IPsec.Enable', False, TrParameterType.BOOLEAN, False,
+        ),
+        ParameterName.PERIODIC_INFORM_INTERVAL:
+            TrParam(DEVICE_PATH + 'ManagementServer.PeriodicInformInterval', False, TrParameterType.UNSIGNED_INT, False),
+
+        # Management server parameters
+        ParameterName.PERIODIC_INFORM_ENABLE: TrParam(
+                DEVICE_PATH + 'ManagementServer.PeriodicInformEnable',
+                False, TrParameterType.BOOLEAN, False,
+        ),
+        ParameterName.PERIODIC_INFORM_INTERVAL: TrParam(
+                DEVICE_PATH + 'ManagementServer.PeriodicInformInterval',
+                False, TrParameterType.UNSIGNED_INT, False,
+        ),
+
+        # Performance management parameters
+        ParameterName.PERF_MGMT_ENABLE: TrParam(
+            FAPSERVICE_PATH + 'PerfMgmt.Config.1.Enable', False, TrParameterType.BOOLEAN, False,
+        ),
+        ParameterName.PERF_MGMT_UPLOAD_INTERVAL: TrParam(
+            FAPSERVICE_PATH + 'PerfMgmt.Config.1.PeriodicUploadInterval', False, TrParameterType.UNSIGNED_INT, False,
+        ),
+        ParameterName.PERF_MGMT_UPLOAD_URL: TrParam(
+            FAPSERVICE_PATH + 'PerfMgmt.Config.1.URL', False, TrParameterType.STRING, False,
+        ),
+        ParameterName.PERF_MGMT_USER: TrParam(
+            FAPSERVICE_PATH + 'PerfMgmt.Config.1.Username',
+            False, TrParameterType.STRING, False,
+        ),
+        ParameterName.PERF_MGMT_PASSWORD: TrParam(
+            FAPSERVICE_PATH + 'PerfMgmt.Config.1.Password',
+            False, TrParameterType.STRING, False,
+        ),
+
+        # PLMN Info
+        ParameterName.PLMN_LIST: TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.', False, TrParameterType.OBJECT, False,
+        ),
+    }
+
+    NUM_PLMNS_IN_CONFIG = 6
+    for i in range(1, NUM_PLMNS_IN_CONFIG + 1):
+        PARAMETERS[ParameterName.PLMN_N % i] = TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.' % i, True, TrParameterType.OBJECT, False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_CELL_RESERVED % i] = TrParam(
+            FAPSERVICE_PATH
+            + 'CellConfig.LTE.EPC.PLMNList.%d.CellReservedForOperatorUse' % i, True, TrParameterType.BOOLEAN, False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_ENABLE % i] = TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.Enable' % i, True, TrParameterType.BOOLEAN, False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_PRIMARY % i] = TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.IsPrimary' % i, True, TrParameterType.BOOLEAN, False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_PLMNID % i] = TrParam(
+            FAPSERVICE_PATH + 'CellConfig.LTE.EPC.PLMNList.%d.PLMNID' % i, True, TrParameterType.STRING, False,
+        )
+
+    TRANSFORMS_FOR_ENB = {
+        ParameterName.DL_BANDWIDTH: transform_for_enb.bandwidth,
+        ParameterName.UL_BANDWIDTH: transform_for_enb.bandwidth,
+    }
+    TRANSFORMS_FOR_MAGMA = {
+        ParameterName.DL_BANDWIDTH: transform_for_magma.bandwidth,
+        ParameterName.UL_BANDWIDTH: transform_for_magma.bandwidth,
+        # We don't set GPS, so we don't need transform for enb
+        ParameterName.GPS_LAT: transform_for_magma.gps_tr181,
+        ParameterName.GPS_LONG: transform_for_magma.gps_tr181,
+    }
+
+    @classmethod
+    def get_parameter(cls, param_name: ParameterName) -> Optional[TrParam]:
+        return cls.PARAMETERS.get(param_name)
+
+    @classmethod
+    def _get_magma_transforms(
+        cls,
+    ) -> Dict[ParameterName, Callable[[Any], Any]]:
+        return cls.TRANSFORMS_FOR_MAGMA
+
+    @classmethod
+    def _get_enb_transforms(cls) -> Dict[ParameterName, Callable[[Any], Any]]:
+        return cls.TRANSFORMS_FOR_ENB
+
+    @classmethod
+    def get_load_parameters(cls) -> List[ParameterName]:
+        """
+        Load all the parameters instead of a subset.
+        """
+        return [ParameterName.DEVICE]
+
+    @classmethod
+    def get_num_plmns(cls) -> int:
+        return cls.NUM_PLMNS_IN_CONFIG
+
+    @classmethod
+    def get_parameter_names(cls) -> List[ParameterName]:
+        excluded_params = [
+            str(ParameterName.DEVICE),
+            str(ParameterName.FAP_SERVICE),
+        ]
+        names = list(
+            filter(
+                lambda x: (not str(x).startswith('PLMN'))
+                and (str(x) not in excluded_params),
+                cls.PARAMETERS.keys(),
+            ),
+        )
+        return names
+
+    @classmethod
+    def get_numbered_param_names(
+        cls,
+    ) -> Dict[ParameterName, List[ParameterName]]:
+        names = {}
+        for i in range(1, cls.NUM_PLMNS_IN_CONFIG + 1):
+            params = []
+            params.append(ParameterName.PLMN_N_CELL_RESERVED % i)
+            params.append(ParameterName.PLMN_N_ENABLE % i)
+            params.append(ParameterName.PLMN_N_PRIMARY % i)
+            params.append(ParameterName.PLMN_N_PLMNID % i)
+            names[ParameterName.PLMN_N % i] = params
+        return names
+
+
+class CaviumTrConfigurationInitializer(EnodebConfigurationPostProcessor):
+    def postprocess(self, mconfig: Any, service_cfg: Any, desired_cfg: EnodebConfiguration) -> None:
+        desired_cfg.set_parameter(ParameterName.CELL_BARRED, True)
+        desired_cfg.set_parameter(ParameterName.ADMIN_STATE, True)
diff --git a/devices/freedomfi_one.py b/devices/freedomfi_one.py
new file mode 100644
index 0000000..e9bf9b0
--- /dev/null
+++ b/devices/freedomfi_one.py
@@ -0,0 +1,1096 @@
+"""
+Copyright 2020 The Magma Authors.
+
+This source code is licensed under the BSD-style license found in the
+LICENSE file in the root directory of this source tree.
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+"""
+import logging
+from typing import Any, Callable, Dict, List, Optional, Type
+
+from common.service import MagmaService
+from data_models import transform_for_magma
+from data_models.data_model import (
+    DataModel,
+    InvalidTrParamPath,
+    TrParam,
+)
+from data_models.data_model_parameters import (
+    ParameterName,
+    TrParameterType,
+)
+from device_config.configuration_init import build_desired_config
+from device_config.enodeb_config_postprocessor import EnodebConfigurationPostProcessor
+from device_config.enodeb_configuration import EnodebConfiguration
+from devices.device_utils import EnodebDeviceName
+from logger import EnodebdLogger
+from state_machines.acs_state_utils import (
+    get_all_objects_to_add,
+    get_all_objects_to_delete,
+    get_all_param_values_to_set,
+    get_params_to_get,
+    parse_get_parameter_values_response,
+)
+from state_machines.enb_acs import EnodebAcsStateMachine
+from state_machines.enb_acs_impl import BasicEnodebAcsStateMachine
+from state_machines.enb_acs_states import (
+    AcsMsgAndTransition,
+    AcsReadMsgResult,
+    AddObjectsState,
+    DeleteObjectsState,
+    EnbSendRebootState,
+    EndSessionState,
+    EnodebAcsState,
+    ErrorState,
+    GetParametersState,
+    SetParameterValuesState,
+    WaitGetParametersState,
+    WaitInformMRebootState,
+    WaitInformState,
+    WaitRebootResponseState,
+    WaitSetParameterValuesState,
+)
+from tr069 import models
+
+
+class SASParameters:
+    """ Class modeling the SAS parameters and their TR path"""
+
+    # SAS parameters for FreedomFiOne
+    FAP_CONTROL = "Device.Services.FAPService.1.FAPControl."
+    FAPSERVICE_PATH = "Device.Services.FAPService.1."
+
+    # Sas management parameters
+    SAS_ENABLE = "sas_enabled"
+    SAS_SERVER_URL = "sas_server_url"
+    SAS_UID = "sas_uid"
+    SAS_CATEGORY = "sas_category"
+    SAS_CHANNEL_TYPE = "sas_channel_type"
+    SAS_CERT_SUBJECT = "sas_cert_subject"
+    SAS_IC_GROUP_ID = "sas_icg_group_id"
+    SAS_LOCATION = "sas_location"
+    SAS_HEIGHT_TYPE = "sas_height_type"
+    SAS_CPI_ENABLE = "sas_cpi_enable"
+    SAS_CPI_IPE = "sas_cpi_ipe"  # Install param supplied enable
+    FREQ_BAND_1 = "freq_band_1"
+    FREQ_BAND_2 = "freq_band_2"
+    # For CBRS radios we set this to the limit and the SAS can reduce the
+    # power if needed.
+    TX_POWER_CONFIG = "tx_power_config"
+
+    SAS_PARAMETERS = {
+        SAS_ENABLE: TrParam(
+            FAP_CONTROL + "LTE.X_000E8F_SAS.Enable",
+            is_invasive=False,
+            type=TrParameterType.BOOLEAN,
+            is_optional=False,
+        ),
+        SAS_SERVER_URL: TrParam(
+            FAP_CONTROL + "LTE.X_000E8F_SAS.Server",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        SAS_UID: TrParam(
+            FAP_CONTROL + "LTE.X_000E8F_SAS.UserContactInformation",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        SAS_CATEGORY: TrParam(
+            FAP_CONTROL + "LTE.X_000E8F_SAS.Category",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        SAS_CHANNEL_TYPE: TrParam(
+            FAP_CONTROL + "LTE.X_000E8F_SAS.ProtectionLevel",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        SAS_CERT_SUBJECT: TrParam(
+            FAP_CONTROL + "LTE.X_000E8F_SAS.CertSubject",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        # SAS_IC_GROUP_ID: TrParam(
+        #     FAP_CONTROL + 'LTE.X_000E8F_SAS.ICGGroupId', is_invasive=False,
+        #     type=TrParameterType.STRING, False),
+        SAS_LOCATION: TrParam(
+            FAP_CONTROL + "LTE.X_000E8F_SAS.Location",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        SAS_HEIGHT_TYPE: TrParam(
+            FAP_CONTROL + "LTE.X_000E8F_SAS.HeightType",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        SAS_CPI_ENABLE: TrParam(
+            FAP_CONTROL + "LTE.X_000E8F_SAS.CPIEnable",
+            is_invasive=False,
+            type=TrParameterType.BOOLEAN,
+            is_optional=False,
+        ),
+        SAS_CPI_IPE: TrParam(
+            FAP_CONTROL + "LTE.X_000E8F_SAS.CPIInstallParamSuppliedEnable",
+            is_invasive=False,
+            type=TrParameterType.BOOLEAN,
+            is_optional=False,
+        ),
+        FREQ_BAND_1: TrParam(
+            FAPSERVICE_PATH + "CellConfig.LTE.RAN.RF.FreqBandIndicator",
+            is_invasive=False,
+            type=TrParameterType.UNSIGNED_INT,
+            is_optional=False,
+        ),
+        FREQ_BAND_2: TrParam(
+            FAPSERVICE_PATH + "CellConfig.LTE.RAN.RF.X_000E8F_FreqBandIndicator2",
+            is_invasive=False,
+            type=TrParameterType.UNSIGNED_INT,
+            is_optional=False,
+        ),
+        TX_POWER_CONFIG: TrParam(
+            FAPSERVICE_PATH + "CellConfig.LTE.RAN.RF.X_000E8F_TxPowerConfig",
+            is_invasive=True,
+            type=TrParameterType.INT,
+            is_optional=False,
+        ),
+    }
+
+
+class StatusParameters:
+    """
+    Stateful class that converts eNB status to Magma understood status.
+    FreedomFiOne has many status params that interact with each other.
+    This class maintains the business logic of parsing these status params
+    and converting it to Magma understood fields.
+    """
+
+    STATUS_PATH = "Device.X_000E8F_DeviceFeature.X_000E8F_NEStatus."
+
+    # Status parameters
+    DEFAULT_GW = "defaultGW"
+    SYNC_STATUS = "syncStatus"
+    SAS_STATUS = "sasStatus"
+    ENB_STATUS = "enbStatus"
+    GPS_SCAN_STATUS = "gpsScanStatus"
+
+    STATUS_PARAMETERS = {
+        # Status nodes
+        DEFAULT_GW: TrParam(
+            STATUS_PATH + "X_000E8F_DEFGW_Status",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        SYNC_STATUS: TrParam(
+            STATUS_PATH + "X_000E8F_Sync_Status",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        SAS_STATUS: TrParam(
+            STATUS_PATH + "X_000E8F_SAS_Status",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        ENB_STATUS: TrParam(
+            STATUS_PATH + "X_000E8F_eNB_Status",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        # GPS status, lat, long
+        GPS_SCAN_STATUS: TrParam(
+            "Device.FAP.GPS.ScanStatus",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        ParameterName.GPS_LAT: TrParam(
+            "Device.FAP.GPS.LockedLatitude",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        ParameterName.GPS_LONG: TrParam(
+            "Device.FAP.GPS.LockedLongitude",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+    }
+
+    # Derived status params that don't have tr69 representation.
+    DERIVED_STATUS_PARAMETERS = {
+        ParameterName.RF_TX_STATUS: TrParam(
+            InvalidTrParamPath,
+            is_invasive=False,
+            type=TrParameterType.BOOLEAN,
+            is_optional=False,
+        ),
+        ParameterName.GPS_STATUS: TrParam(
+            InvalidTrParamPath,
+            is_invasive=False,
+            type=TrParameterType.BOOLEAN,
+            is_optional=False,
+        ),
+        ParameterName.PTP_STATUS: TrParam(
+            InvalidTrParamPath,
+            is_invasive=False,
+            type=TrParameterType.BOOLEAN,
+            is_optional=False,
+        ),
+        ParameterName.MME_STATUS: TrParam(
+            InvalidTrParamPath,
+            is_invasive=False,
+            type=TrParameterType.BOOLEAN,
+            is_optional=False,
+        ),
+        ParameterName.OP_STATE: TrParam(
+            InvalidTrParamPath,
+            is_invasive=False,
+            type=TrParameterType.BOOLEAN,
+            is_optional=False,
+        ),
+    }
+
+    @classmethod
+    def set_magma_device_cfg(
+        cls, name_to_val: Dict, device_cfg: EnodebConfiguration,
+    ):
+        """
+        Convert FreedomFiOne name_to_val representation to magma device_cfg
+        """
+        success_str = "SUCCESS"  # String constant returned by radio
+        insync_str = "INSYNC"
+
+        if (
+            name_to_val.get(cls.DEFAULT_GW)
+            and name_to_val[cls.DEFAULT_GW].upper() != success_str
+        ):
+            # Nothing will proceed if the eNB doesn't have an IP on the WAN
+            serial_num = "unknown"
+            if device_cfg.has_parameter(ParameterName.SERIAL_NUMBER):
+                serial_num = device_cfg.get_parameter(ParameterName.SERIAL_NUMBER,)
+            EnodebdLogger.error(
+                "Radio with serial number %s doesn't have IP address " "on WAN",
+                serial_num,
+            )
+            device_cfg.set_parameter(
+                param_name=ParameterName.RF_TX_STATUS, value=False,
+            )
+            device_cfg.set_parameter(
+                param_name=ParameterName.GPS_STATUS, value=False,
+            )
+            device_cfg.set_parameter(
+                param_name=ParameterName.PTP_STATUS, value=False,
+            )
+            device_cfg.set_parameter(
+                param_name=ParameterName.MME_STATUS, value=False,
+            )
+            device_cfg.set_parameter(
+                param_name=ParameterName.OP_STATE, value=False,
+            )
+            return
+
+        if (
+            name_to_val.get(cls.SAS_STATUS)
+            and name_to_val[cls.SAS_STATUS].upper() == success_str
+        ):
+            device_cfg.set_parameter(
+                param_name=ParameterName.RF_TX_STATUS, value=True,
+            )
+        else:
+            # No sas grant so not transmitting. There is no explicit node for Tx
+            # in FreedomFiOne
+            device_cfg.set_parameter(
+                param_name=ParameterName.RF_TX_STATUS, value=False,
+            )
+
+        if (
+            name_to_val.get(cls.GPS_SCAN_STATUS)
+            and name_to_val[cls.GPS_SCAN_STATUS].upper() == success_str
+        ):
+            device_cfg.set_parameter(
+                param_name=ParameterName.GPS_STATUS, value=True,
+            )
+            # Time comes through GPS so can only be insync with GPS is
+            # in sync, we use PTP_STATUS field to overload timer is in Sync.
+            if (
+                name_to_val.get(cls.SYNC_STATUS)
+                and name_to_val[cls.SYNC_STATUS].upper() == insync_str
+            ):
+                device_cfg.set_parameter(
+                    param_name=ParameterName.PTP_STATUS, value=True,
+                )
+            else:
+                device_cfg.set_parameter(
+                    param_name=ParameterName.PTP_STATUS, value=False,
+                )
+        else:
+            device_cfg.set_parameter(
+                param_name=ParameterName.GPS_STATUS, value=False,
+            )
+            device_cfg.set_parameter(
+                param_name=ParameterName.PTP_STATUS, value=False,
+            )
+
+        if (
+            name_to_val.get(cls.DEFAULT_GW)
+            and name_to_val[cls.DEFAULT_GW].upper() == success_str
+        ):
+            device_cfg.set_parameter(
+                param_name=ParameterName.MME_STATUS, value=True,
+            )
+        else:
+            device_cfg.set_parameter(
+                param_name=ParameterName.MME_STATUS, value=False,
+            )
+
+        if (
+            name_to_val.get(cls.ENB_STATUS)
+            and name_to_val[cls.ENB_STATUS].upper() == success_str
+        ):
+            device_cfg.set_parameter(
+                param_name=ParameterName.OP_STATE, value=True,
+            )
+        else:
+            device_cfg.set_parameter(
+                param_name=ParameterName.OP_STATE, value=False,
+            )
+
+        pass_through_params = [ParameterName.GPS_LAT, ParameterName.GPS_LONG]
+        for name in pass_through_params:
+            device_cfg.set_parameter(name, name_to_val[name])
+
+
+class FreedomFiOneMiscParameters:
+    """
+    Default set of parameters that enable carrier aggregation and other
+    miscellaneous properties
+    """
+
+    FAP_CONTROL = "Device.Services.FAPService.1.FAPControl."
+    FAPSERVICE_PATH = "Device.Services.FAPService.1."
+
+    # Tunnel ref format clobber it to non IPSEC as we don't support
+    # IPSEC
+    TUNNEL_REF = "tunnel_ref"
+    PRIM_SOURCE = "prim_src"
+
+    # Carrier aggregation
+    CARRIER_AGG_ENABLE = "carrier_agg_enable"
+    CARRIER_NUMBER = "carrier_number"  # Carrier aggregation params
+    CONTIGUOUS_CC = "contiguous_cc"
+    WEB_UI_ENABLE = "web_ui_enable"  # Enable or disable local enb UI
+
+    MISC_PARAMETERS = {
+        WEB_UI_ENABLE: TrParam(
+            "Device.X_000E8F_DeviceFeature.X_000E8F_WebServerEnable",
+            is_invasive=False,
+            type=TrParameterType.BOOLEAN,
+            is_optional=False,
+        ),
+        CARRIER_AGG_ENABLE: TrParam(
+            FAP_CONTROL + "LTE.X_000E8F_RRMConfig.X_000E8F_CA_Enable",
+            is_invasive=False,
+            type=TrParameterType.BOOLEAN,
+            is_optional=False,
+        ),
+        CARRIER_NUMBER: TrParam(
+            FAP_CONTROL + "LTE.X_000E8F_RRMConfig.X_000E8F_Cell_Number",
+            is_invasive=False,
+            type=TrParameterType.INT,
+            is_optional=False,
+        ),
+        CONTIGUOUS_CC: TrParam(
+            FAP_CONTROL + "LTE.X_000E8F_RRMConfig.X_000E8F_CELL_Freq_Contiguous",
+            is_invasive=False,
+            type=TrParameterType.INT,
+            is_optional=False,
+        ),
+        TUNNEL_REF: TrParam(
+            FAPSERVICE_PATH + "CellConfig.LTE.Tunnel.1.TunnelRef",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        PRIM_SOURCE: TrParam(
+            FAPSERVICE_PATH + "REM.X_000E8F_tfcsManagerConfig.primSrc",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+    }
+
+    # Hardcoded defaults
+    defaults = {
+        # Use IPV4 only
+        TUNNEL_REF: "Device.IP.Interface.1.IPv4Address.1.",
+        # Only synchronize with GPS
+        PRIM_SOURCE: "GNSS",
+        # Always enable carrier aggregation for the CBRS bands
+        CARRIER_AGG_ENABLE: True,
+        CARRIER_NUMBER: 2,  # CBRS has two carriers
+        CONTIGUOUS_CC: 0,  # Its not contiguous carrier
+        WEB_UI_ENABLE: False,  # Disable WebUI by default
+    }
+
+
+class FreedomFiOneHandler(BasicEnodebAcsStateMachine):
+    def __init__(self, service: MagmaService,) -> None:
+        self._state_map = {}
+        super().__init__(service=service, use_param_key=True)
+
+    def reboot_asap(self) -> None:
+        self.transition("reboot")
+
+    def is_enodeb_connected(self) -> bool:
+        return not isinstance(self.state, WaitInformState)
+
+    def _init_state_map(self) -> None:
+        self._state_map = {
+            # Inform comes in -> Respond with InformResponse
+            "wait_inform": WaitInformState(self, when_done="get_rpc_methods"),
+            # If first inform after boot -> GetRpc request comes in, if not
+            # empty request comes in => Transition to get_transient_params
+            "get_rpc_methods": FreedomFiOneGetInitState(
+                self, when_done="get_transient_params",
+            ),
+            # Read transient readonly params.
+            "get_transient_params": FreedomFiOneSendGetTransientParametersState(
+                self, when_done="get_params",
+            ),
+            "get_params": FreedomFiOneGetObjectParametersState(
+                self,
+                when_delete="delete_objs",
+                when_add="add_objs",
+                when_set="set_params",
+                when_skip="end_session",
+            ),
+            "delete_objs": DeleteObjectsState(
+                self, when_add="add_objs", when_skip="set_params",
+            ),
+            "add_objs": AddObjectsState(self, when_done="set_params"),
+            "set_params": SetParameterValuesState(self, when_done="wait_set_params",),
+            "wait_set_params": WaitSetParameterValuesState(
+                self,
+                when_done="check_get_params",
+                when_apply_invasive="check_get_params",
+                status_non_zero_allowed=True,
+            ),
+            "check_get_params": GetParametersState(
+                self, when_done="check_wait_get_params", request_all_params=True,
+            ),
+            "check_wait_get_params": WaitGetParametersState(
+                self, when_done="end_session",
+            ),
+            "end_session": EndSessionState(self),
+            # These states are only entered through manual user intervention
+            "reboot": EnbSendRebootState(self, when_done="wait_reboot"),
+            "wait_reboot": WaitRebootResponseState(
+                self, when_done="wait_post_reboot_inform",
+            ),
+            "wait_post_reboot_inform": WaitInformMRebootState(
+                self, when_done="wait_empty", when_timeout="wait_inform",
+            ),
+            # The states below are entered when an unexpected message type is
+            # received
+            "unexpected_fault": ErrorState(
+                self, inform_transition_target="wait_inform",
+            ),
+        }
+
+    @property
+    def device_name(self) -> str:
+        return EnodebDeviceName.FREEDOMFI_ONE
+
+    @property
+    def data_model_class(self) -> Type[DataModel]:
+        return FreedomFiOneTrDataModel
+
+    @property
+    def config_postprocessor(self) -> EnodebConfigurationPostProcessor:
+        return FreedomFiOneConfigurationInitializer(self)
+
+    @property
+    def state_map(self) -> Dict[str, EnodebAcsState]:
+        return self._state_map
+
+    @property
+    def disconnected_state_name(self) -> str:
+        return "wait_inform"
+
+    @property
+    def unexpected_fault_state_name(self) -> str:
+        return "unexpected_fault"
+
+
+class FreedomFiOneTrDataModel(DataModel):
+    """
+    Class to represent relevant data model parameters from TR-196/TR-098.
+    This class is effectively read-only.
+
+    These models have these idiosyncrasies (on account of running TR098):
+
+    - Parameter content root is different (InternetGatewayDevice)
+    - GetParameter queries with a wildcard e.g. InternetGatewayDevice. do
+      not respond with the full tree (we have to query all parameters)
+    - MME status is not exposed - we assume the MME is connected if
+      the eNodeB is transmitting (OpState=true)
+    - Parameters such as band capability/duplex config
+      are rooted under `boardconf.` and not the device config root
+    - Num PLMNs is not reported by these units
+    """
+
+    # Mapping of TR parameter paths to aliases
+    DEVICE_PATH = "Device."
+    FAPSERVICE_PATH = DEVICE_PATH + "Services.FAPService.1."
+    FAP_CONTROL = FAPSERVICE_PATH + "FAPControl."
+    BCCH = FAPSERVICE_PATH + "REM.LTE.Cell.1.BCCH."
+
+    PARAMETERS = {
+        # Top-level objects
+        ParameterName.DEVICE: TrParam(
+            DEVICE_PATH,
+            is_invasive=False,
+            type=TrParameterType.OBJECT,
+            is_optional=False,
+        ),
+        ParameterName.FAP_SERVICE: TrParam(
+            FAP_CONTROL,
+            is_invasive=False,
+            type=TrParameterType.OBJECT,
+            is_optional=False,
+        ),
+        # Device info
+        ParameterName.SW_VERSION: TrParam(
+            DEVICE_PATH + "DeviceInfo.SoftwareVersion",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        ParameterName.SERIAL_NUMBER: TrParam(
+            DEVICE_PATH + "DeviceInfo.SerialNumber",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        # RF-related parameters
+        ParameterName.EARFCNDL: TrParam(
+            FAPSERVICE_PATH + "CellConfig.LTE.RAN.RF.EARFCNDL",
+            is_invasive=False,
+            type=TrParameterType.INT,
+            is_optional=False,
+        ),
+        ParameterName.DL_BANDWIDTH: TrParam(
+            FAPSERVICE_PATH + "CellConfig.LTE.RAN.RF.DLBandwidth",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        ParameterName.UL_BANDWIDTH: TrParam(
+            FAPSERVICE_PATH + "CellConfig.LTE.RAN.RF.ULBandwidth",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        ParameterName.PCI: TrParam(
+            FAPSERVICE_PATH + "CellConfig.LTE.RAN.RF.PhyCellID",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        ParameterName.SUBFRAME_ASSIGNMENT: TrParam(
+            FAPSERVICE_PATH + "CellConfig.LTE.RAN.PHY.TDDFrame.SubFrameAssignment",
+            is_invasive=False,
+            type=TrParameterType.BOOLEAN,
+            is_optional=False,
+        ),
+        ParameterName.SPECIAL_SUBFRAME_PATTERN: TrParam(
+            FAPSERVICE_PATH + "CellConfig.LTE.RAN.PHY.TDDFrame.SpecialSubframePatterns",
+            is_invasive=False,
+            type=TrParameterType.INT,
+            is_optional=False,
+        ),
+        ParameterName.CELL_ID: TrParam(
+            FAPSERVICE_PATH + "CellConfig.LTE.RAN.Common.CellIdentity",
+            is_invasive=False,
+            type=TrParameterType.UNSIGNED_INT,
+            is_optional=False,
+        ),
+        # Readonly LTE state
+        ParameterName.ADMIN_STATE: TrParam(
+            FAP_CONTROL + "LTE.AdminState",
+            is_invasive=False,
+            type=TrParameterType.BOOLEAN,
+            is_optional=False,
+        ),
+        ParameterName.GPS_ENABLE: TrParam(
+            DEVICE_PATH + "FAP.GPS.ScanOnBoot",
+            is_invasive=False,
+            type=TrParameterType.BOOLEAN,
+            is_optional=False,
+        ),
+        # Core network parameters
+        ParameterName.MME_IP: TrParam(
+            FAP_CONTROL + "LTE.Gateway.S1SigLinkServerList",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+        ParameterName.MME_PORT: TrParam(
+            FAP_CONTROL + "LTE.Gateway.S1SigLinkPort",
+            is_invasive=False,
+            type=TrParameterType.INT,
+            is_optional=False,
+        ),
+        ParameterName.NUM_PLMNS: TrParam(
+            FAPSERVICE_PATH + "CellConfig.LTE.EPC.PLMNListNumberOfEntries",
+            is_invasive=False,
+            type=TrParameterType.INT,
+            is_optional=False,
+        ),
+        ParameterName.TAC: TrParam(
+            FAPSERVICE_PATH + "CellConfig.LTE.EPC.TAC",
+            is_invasive=False,
+            type=TrParameterType.INT,
+            is_optional=False,
+        ),
+        # Management server parameters
+        ParameterName.PERIODIC_INFORM_ENABLE: TrParam(
+            DEVICE_PATH + "ManagementServer.PeriodicInformEnable",
+            is_invasive=False,
+            type=TrParameterType.BOOLEAN,
+            is_optional=False,
+        ),
+        ParameterName.PERIODIC_INFORM_INTERVAL: TrParam(
+            DEVICE_PATH + "ManagementServer.PeriodicInformInterval",
+            is_invasive=False,
+            type=TrParameterType.INT,
+            is_optional=False,
+        ),
+        # Performance management parameters
+        ParameterName.PERF_MGMT_ENABLE: TrParam(
+            DEVICE_PATH + "FAP.PerfMgmt.Config.1.Enable",
+            is_invasive=False,
+            type=TrParameterType.BOOLEAN,
+            is_optional=False,
+        ),
+        ParameterName.PERF_MGMT_UPLOAD_INTERVAL: TrParam(
+            DEVICE_PATH + "FAP.PerfMgmt.Config.1.PeriodicUploadInterval",
+            is_invasive=False,
+            type=TrParameterType.INT,
+            is_optional=False,
+        ),
+        ParameterName.PERF_MGMT_UPLOAD_URL: TrParam(
+            DEVICE_PATH + "FAP.PerfMgmt.Config.1.URL",
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        ),
+    }
+    TRANSFORMS_FOR_ENB = {}
+    NUM_PLMNS_IN_CONFIG = 1
+    for i in range(1, NUM_PLMNS_IN_CONFIG + 1):
+        PARAMETERS[ParameterName.PLMN_N % i] = TrParam(
+            FAPSERVICE_PATH + "CellConfig.LTE.EPC.PLMNList.%d." % i,
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_CELL_RESERVED % i] = TrParam(
+            FAPSERVICE_PATH
+            + "CellConfig.LTE.EPC.PLMNList.%d.CellReservedForOperatorUse" % i,
+            is_invasive=False,
+            type=TrParameterType.BOOLEAN,
+            is_optional=False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_ENABLE % i] = TrParam(
+            FAPSERVICE_PATH + "CellConfig.LTE.EPC.PLMNList.%d.Enable" % i,
+            is_invasive=False,
+            type=TrParameterType.BOOLEAN,
+            is_optional=False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_PRIMARY % i] = TrParam(
+            FAPSERVICE_PATH + "CellConfig.LTE.EPC.PLMNList.%d.IsPrimary" % i,
+            is_invasive=False,
+            type=TrParameterType.BOOLEAN,
+            is_optional=False,
+        )
+        PARAMETERS[ParameterName.PLMN_N_PLMNID % i] = TrParam(
+            FAPSERVICE_PATH + "CellConfig.LTE.EPC.PLMNList.%d.PLMNID" % i,
+            is_invasive=False,
+            type=TrParameterType.STRING,
+            is_optional=False,
+        )
+
+    PARAMETERS.update(SASParameters.SAS_PARAMETERS)
+    PARAMETERS.update(FreedomFiOneMiscParameters.MISC_PARAMETERS)
+    PARAMETERS.update(StatusParameters.STATUS_PARAMETERS)
+    # These are stateful parameters that have no tr-69 representation
+    PARAMETERS.update(StatusParameters.DERIVED_STATUS_PARAMETERS)
+
+    TRANSFORMS_FOR_MAGMA = {
+        # We don't set these parameters
+        ParameterName.BAND_CAPABILITY: transform_for_magma.band_capability,
+        ParameterName.DUPLEX_MODE_CAPABILITY: transform_for_magma.duplex_mode,
+    }
+
+    @classmethod
+    def get_parameter(cls, param_name: ParameterName) -> Optional[TrParam]:
+        return cls.PARAMETERS.get(param_name)
+
+    @classmethod
+    def _get_magma_transforms(cls,) -> Dict[ParameterName, Callable[[Any], Any]]:
+        return cls.TRANSFORMS_FOR_MAGMA
+
+    @classmethod
+    def _get_enb_transforms(cls) -> Dict[ParameterName, Callable[[Any], Any]]:
+        return cls.TRANSFORMS_FOR_ENB
+
+    @classmethod
+    def get_load_parameters(cls) -> List[ParameterName]:
+        """
+        Load all the parameters instead of a subset.
+        """
+        return list(cls.PARAMETERS.keys())
+
+    @classmethod
+    def get_num_plmns(cls) -> int:
+        return cls.NUM_PLMNS_IN_CONFIG
+
+    @classmethod
+    def get_parameter_names(cls) -> List[ParameterName]:
+        excluded_params = [
+            str(ParameterName.DEVICE),
+            str(ParameterName.FAP_SERVICE),
+        ]
+        names = list(
+            filter(
+                lambda x: (not str(x).startswith("PLMN"))
+                and (str(x) not in excluded_params),
+                cls.PARAMETERS.keys(),
+            ),
+        )
+        return names
+
+    @classmethod
+    def get_numbered_param_names(cls,) -> Dict[ParameterName, List[ParameterName]]:
+        names = {}
+        for i in range(1, cls.NUM_PLMNS_IN_CONFIG + 1):
+            params = [
+                ParameterName.PLMN_N_CELL_RESERVED % i,
+                ParameterName.PLMN_N_ENABLE % i,
+                ParameterName.PLMN_N_PRIMARY % i,
+                ParameterName.PLMN_N_PLMNID % i,
+            ]
+            names[ParameterName.PLMN_N % i] = params
+
+        return names
+
+    @classmethod
+    def get_sas_param_names(cls) -> List[ParameterName]:
+        return SASParameters.SAS_PARAMETERS.keys()
+
+
+class FreedomFiOneConfigurationInitializer(EnodebConfigurationPostProcessor):
+    """
+    Class to add the sas related parameters to the desired config.
+    """
+
+    SAS_KEY = "sas"
+    WEB_UI_ENABLE_LIST_KEY = "web_ui_enable_list"
+
+    def __init__(self, acs: EnodebAcsStateMachine):
+        super().__init__()
+        self.acs = acs
+
+    def postprocess(
+        self, mconfig: Any, service_cfg: Any, desired_cfg: EnodebConfiguration,
+    ) -> None:
+        # TODO: Get this config from the domain proxy
+        # TODO @amarpad, set these when DProxy integration is done.
+        # For now the radio will directly talk to the SAS and get these
+        # attributes.
+        desired_cfg.delete_parameter(ParameterName.EARFCNDL)
+        desired_cfg.delete_parameter(ParameterName.DL_BANDWIDTH)
+        desired_cfg.delete_parameter(ParameterName.UL_BANDWIDTH)
+
+        # go through misc parameters and set them to default.
+        for name, val in FreedomFiOneMiscParameters.defaults.items():
+            desired_cfg.set_parameter(name, val)
+
+        # Bump up the parameter key version
+        self.acs.parameter_version_inc()
+
+        if self.WEB_UI_ENABLE_LIST_KEY in service_cfg:
+            serial_nos = service_cfg.get(self.WEB_UI_ENABLE_LIST_KEY)
+            if self.acs.device_cfg.has_parameter(ParameterName.SERIAL_NUMBER,):
+                if self.acs.get_parameter(ParameterName.SERIAL_NUMBER) in serial_nos:
+                    desired_cfg.set_parameter(
+                        FreedomFiOneMiscParameters.WEB_UI_ENABLE, True,
+                    )
+            else:
+                # This should not happen
+                EnodebdLogger.error("Serial number unknown for device")
+
+        if self.SAS_KEY not in service_cfg:
+            return
+
+        sas_cfg = service_cfg[self.SAS_KEY]
+        sas_param_names = self.acs.data_model.get_sas_param_names()
+        for name, val in sas_cfg.items():
+            if name not in sas_param_names:
+                EnodebdLogger.warning("Ignoring attribute %s", name)
+                continue
+            desired_cfg.set_parameter(name, val)
+
+
+class FreedomFiOneSendGetTransientParametersState(EnodebAcsState):
+    """
+    Periodically read eNodeB status. Note: keep frequency low to avoid
+    backing up large numbers of read operations if enodebd is busy.
+    Some eNB parameters are read only and updated by the eNB itself.
+    """
+
+    def __init__(self, acs: EnodebAcsStateMachine, when_done: str):
+        super().__init__()
+        self.acs = acs
+        self.done_transition = when_done
+
+    def get_msg(self, message: Any) -> AcsMsgAndTransition:
+        request = models.GetParameterValues()
+        request.ParameterNames = models.ParameterNames()
+        request.ParameterNames.string = []
+        for _, tr_param in StatusParameters.STATUS_PARAMETERS.items():
+            path = tr_param.path
+            request.ParameterNames.string.append(path)
+        request.ParameterNames.arrayType = "xsd:string[%d]" % len(
+            request.ParameterNames.string
+        )
+
+        return AcsMsgAndTransition(msg=request, next_state=None)
+
+    def read_msg(self, message: Any) -> AcsReadMsgResult:
+
+        if not isinstance(message, models.GetParameterValuesResponse):
+            return AcsReadMsgResult(msg_handled=False, next_state=None)
+        # Current values of the fetched parameters
+        name_to_val = parse_get_parameter_values_response(self.acs.data_model, message,)
+        EnodebdLogger.debug("Received Parameters: %s", str(name_to_val))
+
+        # Update device configuration
+        StatusParameters.set_magma_device_cfg(
+            name_to_val, self.acs.device_cfg,
+        )
+
+        return AcsReadMsgResult(msg_handled=True, next_state=self.done_transition,)
+
+    def state_description(self) -> str:
+        return "Getting transient read-only parameters"
+
+
+class FreedomFiOneGetInitState(EnodebAcsState):
+    """
+    After the first Inform message the following can happen:
+    1 - eNB can try to learn the RPC method of the ACS, reply back with the
+    RPC response (happens right after boot)
+    2 - eNB can send an empty message -> This means that the eNB is already
+    provisioned so transition to next state. Only transition to next state
+    after this message.
+    3 - Some other method call that we don't care about so ignore.
+    expected that the eNB -> This is an unhandled state so unlikely
+    """
+
+    def __init__(self, acs: EnodebAcsStateMachine, when_done):
+        super().__init__()
+        self.acs = acs
+        self.done_transition = when_done
+        self._is_rpc_request = False
+
+    def get_msg(self, message: Any) -> AcsMsgAndTransition:
+        """
+        Return empty message response if care about this
+        message type otherwise return empty RPC methods response.
+        """
+        if not self._is_rpc_request:
+            resp = models.DummyInput()
+            return AcsMsgAndTransition(msg=resp, next_state=None)
+
+        resp = models.GetRPCMethodsResponse()
+        resp.MethodList = models.MethodList()
+        RPC_METHODS = ["Inform", "GetRPCMethods", "TransferComplete"]
+        resp.MethodList.arrayType = "xsd:string[%d]" % len(RPC_METHODS)
+        resp.MethodList.string = RPC_METHODS
+        # Don't transition to next state wait for the empty HTTP post
+        return AcsMsgAndTransition(msg=resp, next_state=None)
+
+    def read_msg(self, message: Any) -> AcsReadMsgResult:
+        # If this is a regular Inform, not after a reboot we'll get an empty
+        # message, in this case transition to the next state. We consider
+        # this phase as "initialized"
+        if isinstance(message, models.DummyInput):
+            return AcsReadMsgResult(msg_handled=True, next_state=self.done_transition,)
+        if not isinstance(message, models.GetRPCMethods):
+            # Unexpected, just don't die, ignore message.
+            logging.error("Ignoring message %s", str(type(message)))
+            # Set this so get_msg will return an empty message
+            self._is_rpc_request = False
+        else:
+            # Return a valid RPC response
+            self._is_rpc_request = True
+        return AcsReadMsgResult(msg_handled=True, next_state=None)
+
+    def state_description(self) -> str:
+        return "Initializing the post boot sequence for eNB"
+
+
+class FreedomFiOneGetObjectParametersState(EnodebAcsState):
+    """
+    Get information on parameters belonging to objects that can be added or
+    removed from the configuration.
+
+    Englewood will report a parameter value as None if it does not exist
+    in the data model, rather than replying with a Fault message like most
+    eNB devices.
+    """
+
+    def __init__(
+        self,
+        acs: EnodebAcsStateMachine,
+        when_delete: str,
+        when_add: str,
+        when_set: str,
+        when_skip: str,
+    ):
+        super().__init__()
+        self.acs = acs
+        self.rm_obj_transition = when_delete
+        self.add_obj_transition = when_add
+        self.set_params_transition = when_set
+        self.skip_transition = when_skip
+
+    def get_params_to_get(self, data_model: DataModel,) -> List[ParameterName]:
+        names = []
+
+        # First get base params
+        names = get_params_to_get(
+            self.acs.device_cfg, self.acs.data_model, request_all_params=True,
+        )
+        # Add object params.
+        num_plmns = data_model.get_num_plmns()
+        obj_to_params = data_model.get_numbered_param_names()
+        for i in range(1, num_plmns + 1):
+            obj_name = ParameterName.PLMN_N % i
+            desired = obj_to_params[obj_name]
+            names += desired
+        return names
+
+    def get_msg(self, message: Any) -> AcsMsgAndTransition:
+        """ Respond with GetParameterValuesRequest """
+        names = self.get_params_to_get(self.acs.data_model,)
+
+        # Generate the request
+        request = models.GetParameterValues()
+        request.ParameterNames = models.ParameterNames()
+        request.ParameterNames.arrayType = "xsd:string[%d]" % len(names)
+        request.ParameterNames.string = []
+        for name in names:
+            path = self.acs.data_model.get_parameter(name).path
+            if path is not InvalidTrParamPath:
+                # Only get data elements backed by tr69 path
+                request.ParameterNames.string.append(path)
+
+        return AcsMsgAndTransition(msg=request, next_state=None)
+
+    def read_msg(self, message: Any) -> AcsReadMsgResult:
+        """
+        Process GetParameterValuesResponse
+        """
+        if not isinstance(message, models.GetParameterValuesResponse):
+            return AcsReadMsgResult(msg_handled=False, next_state=None)
+
+        path_to_val = {}
+        for param_value_struct in message.ParameterList.ParameterValueStruct:
+            path_to_val[param_value_struct.Name] = param_value_struct.Value.Data
+
+        EnodebdLogger.debug("Received object parameters: %s", str(path_to_val))
+
+        # Parse simple params
+        param_name_list = self.acs.data_model.get_parameter_names()
+        for name in param_name_list:
+            path = self.acs.data_model.get_parameter(name).path
+            if path in path_to_val:
+                value = path_to_val.get(path)
+                magma_val = self.acs.data_model.transform_for_magma(name, value,)
+                self.acs.device_cfg.set_parameter(name, magma_val)
+
+        # Parse object params
+        num_plmns = self.acs.data_model.get_num_plmns()
+        for i in range(1, num_plmns + 1):
+            obj_name = ParameterName.PLMN_N % i
+            obj_to_params = self.acs.data_model.get_numbered_param_names()
+            param_name_list = obj_to_params[obj_name]
+            for name in param_name_list:
+                path = self.acs.data_model.get_parameter(name).path
+                if path in path_to_val:
+                    value = path_to_val.get(path)
+                    if value is None:
+                        continue
+                    if obj_name not in self.acs.device_cfg.get_object_names():
+                        self.acs.device_cfg.add_object(obj_name)
+                    magma_value = self.acs.data_model.transform_for_magma(name, value)
+                    self.acs.device_cfg.set_parameter_for_object(
+                        name, magma_value, obj_name,
+                    )
+        # Now we have enough information to build the desired configuration
+        if self.acs.desired_cfg is None:
+            self.acs.desired_cfg = build_desired_config(
+                self.acs.mconfig,
+                self.acs.service_config,
+                self.acs.device_cfg,
+                self.acs.data_model,
+                self.acs.config_postprocessor,
+            )
+
+        if (
+            len(get_all_objects_to_delete(self.acs.desired_cfg, self.acs.device_cfg,),)
+            > 0
+        ):
+            return AcsReadMsgResult(
+                msg_handled=True, next_state=self.rm_obj_transition,
+            )
+        elif (
+            len(get_all_objects_to_add(self.acs.desired_cfg, self.acs.device_cfg,),) > 0
+        ):
+            return AcsReadMsgResult(
+                msg_handled=True, next_state=self.add_obj_transition,
+            )
+        elif (
+            len(
+                get_all_param_values_to_set(
+                    self.acs.desired_cfg, self.acs.device_cfg, self.acs.data_model,
+                ),
+            )
+            > 0
+        ):
+            return AcsReadMsgResult(
+                msg_handled=True, next_state=self.set_params_transition,
+            )
+        return AcsReadMsgResult(msg_handled=True, next_state=self.skip_transition,)
+
+    def state_description(self) -> str:
+        return "Getting well known parameters"