2019独角兽企业重金招聘Python工程师标准>>> 
AT+CREG
PLMN_SEARCH
一、显示搜不到网
看到08:59:49.354842时间点RIL_CMD_PROXY_3发现请求列表没有request于是一直sleep：
12-17 08:59:49.350004 12091 12103 D RILC-MTK: proxyLoop free pRI=0xb41d8200 p=0xb61f90a0
12-17 08:59:49.350036 12091 12103 D RILC-MTK: proxyLoop free pRequest=0xb41d4500
12-17 08:59:49.350063 12091 12103 D RILC-MTK: proxy id:1, proxyName: RIL_CMD_PROXY_3
12-17 08:59:49.350092 12091 12103 D RILC-MTK: QUERY_NETWORK_SELECTION_MODE pRI=0xb41d8240 p=0xb61f9148 execute on RIL_CMD_PROXY_3 using channel 1
12-17 08:59:49.354790 12091 12103 D RILC-MTK: proxyLoop free pRI=0xb41d8240 p=0xb61f9148
12-17 08:59:49.354819 12091 12103 D RILC-MTK: proxyLoop free pRequest=0xb41d4510
12-17 08:59:49.354842 12091 12103 I RILC-MTK: RIL_CMD_PROXY_3 sleep
……
12-17 08:59:51.689278 12091 12103 I RILC-MTK: RIL_CMD_PROXY_3 sleep
但是，08:59:56时间点modem上报已驻网，通知Framework去同步状态，RILJ有下request到rild，：
12-17 08:59:56.055780 12091 12117 D AT : AT< +CREG: 1,"255F","0000FD9F",0,0,0
12-17 08:59:56.055808 12091 12117 D AT : RIL_URC_READER Enter processLine:+CREG: 1,"255F","0000FD9F",0,0,0
12-17 08:59:56.056728 1533 1796 V RILJ : [UNSL]< UNSOL_RESPONSE_VOICE_NETWORK_STATE_CHANGED {1, 255f, fd9f, 0, 0} [SUB0]
12-17 08:59:56.058354 1533 1533 D GsmSST : [GsmSST0] pollState RadioState is RADIO_ON, currentNetworkMode= 9
12-17 08:59:56.063300 1533 1533 D RILJ : [5491]> VOICE_REGISTRATION_STATE [SUB0] -->该请求在rild中没有看到有建立
怀疑rild的request派发线程一直被占用导致无法处理后续新到的请求。
但是代码中有userloaded的判断，关键log无法看到，请使用eng版本帮忙复现提供log进一步分析确认。
二、LTE网络掉网分析
1.从log中看09:37:15:419 这个时间点就loss了，但是并没有给AP侧上报掉网，这个中间modem做了什么动作呢
302470, 0, 54292552, 09:37:15:419 2017/04/26, MOD_EMM, MOD_EVAL, EVAL_EMM_SAP, MSG_ID_EVAL_EMM_PLMN_LOSS_IND
SYS (PCORE) 1481057 55073116 09:38:04:666 NIL [AT_R p25, s15]+CREG: 3,4,"FFFF","0FFFFFFF",0,0,0
[A] 因为手机必须先进行搜索，如果找不到合适的CELL 才会报掉网到AP
[Q]那中间modem重新找网一直没找到吗，从37:15到38:04，这个过程是否正常要怎么确认呢？按我理解手机不是应该会再去搜索其他小区吗，包括23G的
[A] 是的，从log看来手机有不断进行234G的搜索，尝试很久都搜不到才会上报MM_IDLE_LIMITED_SERVICE ，上报CREG: 0,"给AP，这时候才会显示掉网
Type Index Time Local Time Module Message Comment Time Different
PS (PCORE) 302465 54292552 09:37:15:419 EMM_PLMNSEL - EMM_EVALIF MSG_ID_EMM_PLMNSEL_EVALIF_PLMN_LOSS_IND
PS (PCORE) 302470 54292552 09:37:15:419 EMM - EVAL MSG_ID_EVAL_EMM_PLMN_LOSS_IND
PS (PCORE) 302481 54292554 09:37:15:419 EVAL - NWSEL MSG_ID_NWSEL_EVAL_PLMN_LOSS_IND
PS (PCORE) 303647 54292738 09:37:15:419 NWSEL - MM MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ
PS (PCORE) 303649 54292738 09:37:15:419 MM - RATCM MSG_ID_MM_RATCM_PLMN_SEARCH_REQ
PS (PCORE) 303680 54292749 09:37:15:419 CSE_TDD - SLCE_TDD MSG_ID_TDD_CSE_SLCE_FREQ_SCAN_REQ
PS (PCORE) 303863 54292904 09:37:15:419 SLCE_TDD - RSVAU MSG_ID_TDD_CPHY_FREQUENCY_SCAN_REQ
PS (PCORE) 303865 54292905 09:37:15:419 RSVAU - SLCE_TDD MSG_ID_TDD_CPHY_FREQUENCY_SCAN_CNF
PS (PCORE) 303973 54295566 09:37:15:630 CSE_TDD - CSCE_TDD MSG_ID_TDD_CSCE_CSE_CELL_SELECTION_CNF
PS (PCORE) 303976 54295567 09:37:15:630 CSCE_TDD - RATCM MSG_ID_RATCM_CSCE_PLMN_SEARCH_CNF
PS (PCORE) 303999 54295570 09:37:15:630 RATCM - MM MSG_ID_MM_RATCM_PLMN_SEARCH_CNF
PS (PCORE) 304000 54295570 09:37:15:630 MM - NWSEL MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF
PS (PCORE) 304012 54295573 09:37:15:630 NWSEL - MM MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ
PS (PCORE) 304120 54295726 09:37:15:630 RATCM - RRM_TDD MSG_ID_RATCM_GAS_PLMN_SEARCH_REQ
PS (PCORE) 304302 54305128 09:37:16:321 RRM_TDD - RATCM MSG_ID_RATCM_GAS_PLMN_SEARCH_CNF
PS (PCORE) 304354 54305136 09:37:16:321 MM - NWSEL MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF
PS (PCORE) 304366 54305139 09:37:16:321 NWSEL - MM MSG_ID_NWSEL_MM_DEACTIVATE_REQ
PS (PCORE) 322024 54343879 09:37:18:647 EMM - EVAL MSG_ID_EVAL_EMM_PLMN_SEARCH_CNF
PS (PCORE) 331737 54363627 09:37:19:900 MM - RATCM MSG_ID_MM_RATCM_PLMN_SEARCH_REQ
PS (PCORE) 331738 54363627 09:37:19:900 RATCM - CSCE_TDD MSG_ID_RATCM_CSCE_PLMN_SEARCH_REQ
PS (PCORE) 331980 54366508 09:37:20:249 CSCE_TDD - RATCM MSG_ID_RATCM_CSCE_PLMN_SEARCH_CNF
PS (PCORE) 371531 54613068 09:37:36:029 CSCE_TDD - RATCM MSG_ID_RATCM_CSCE_PLMN_SEARCH_CNF
PS (PCORE) 374021 54885109 09:37:53:283 RRM_TDD - RATCM MSG_ID_RATCM_GAS_PLMN_SEARCH_CNF
PS (PCORE) 374082 54885120 09:37:53:283 RATCM - MM MSG_ID_MM_RATCM_PLMN_SEARCH_CNF
PS (PCORE) 374136 54885127 09:37:53:283 RATCM - RRM_TDD MSG_ID_RATCM_GAS_PLMN_SEARCH_REQ
PS (PCORE) 374873 54901161 09:37:54:464 MM - RAC MSG_ID_GMMREG_DETACH_IND
PS (PCORE) 374880 54901162 09:37:54:464 MM MM new State: MM_IDLE_LIMITED_SERVICE
SYS (PCORE) 375270 54901204 09:37:54:464 NIL [AT_U p19, s8]+CREG: 0,"255F","0000FD8D",0,0,0
SYS (PCORE) 375280 54901207 09:37:54:464 NIL [AT_U p19, s8]+CGREG: 4,"255F","0000FD8D",0,"00",0,0
2.另外这个q_rxlevmin和UE S 准则这些在log里怎么看呢？对应协议是哪份，可否告知下
【A】 Srxlev[-41] = RSRP[-481] - (q_rxlevmin[-440] + q_rxlevmin_offset[0]) - pcomp[0]，这是根据36304的S 准则计算出来的
[Q]网络下发的这个q_rxlevmin在log中怎么看呢，还有手机使用s准则计算的过程
【A】可以从SIB1 里面看出 q-RxLevMin: -110dBm (-55)，S准则的使用就是如 Srxlev[-41] = RSRP[-481] - (q_rxlevmin[-440] + q_rxlevmin_offset[0]) - pcomp[0]，SRXLEV 必须大于0才会显示可以驻留该CELL
三、GSM网络下的掉网问题
1. 先是在服务小区，从-83dBm降到-106.5dBm
Type Index Time Local Time Module Message Comment Time Different
PS 1706982 19082596 19:25:07:880 MPAL_2 - RRM_2 MSG_ID_MPAL_RR_SERV_IDLE_MEAS_IND
PS 1729172 19097470 19:26:22:260 MPAL_2 - RRM_2 MSG_ID_MPAL_RR_SERV_IDLE_MEAS_IND
2. 换到其他小区，信号同样很弱，最终掉网
Type Index Time Local Time Module Message Comment Time Different
PS 1732209 19099353 19:26:31:605 RRM_2 [RMC] C1_reselection on arfcn = 51
PS 1734579 19100672 19:26:38:265 MPAL_2 - RRM_2 MSG_ID_MPAL_RR_SERV_IDLE_MEAS_IND
PS 1736335 19101708 19:26:43:435 MM_2 - NWSEL_2 MSG_ID_NWSEL_MM_PLMN_LOSS_IND
3. 搜索40410，没有搜到
Type Index Time Local Time Module Message Comment Time Different
PS 1741062 19105708 19:27:03:405 NWSEL_2 - MM_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ 40410
PS 1741619 19105850 19:27:04:150 MM_2 - NWSEL_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF
PS 1741623 19105850 19:27:04:150 NWSEL_2 - MM_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ 40410
PS 1747960 19109407 19:27:21:750 MM_2 - NWSEL_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF
4. 找到40505网络，要么随机接入失败，要么出现N200问题
Type Index Time Local Time Module Message Comment Time Different
PS 1747990 19109407 19:27:21:750 NWSEL_2 - MM_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ 40505
PS 1748860 19109707 19:27:23:435 MM_2 - NWSEL_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF
OTA 1748903 19109707 19:27:23:435 MM_2 [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)
OTA 1749207 19109708 19:27:23:435 RRM_2 [MS->NW] RR__CHANNEL_REQUEST
OTA 1749748 19109716 19:27:23:435 RRM_2 [MS->NW] RR__CHANNEL_REQUEST
OTA 1749982 19109924 19:27:24:435 RRM_2 [MS->NW] RR__CHANNEL_REQUEST
OTA 1750234 19110144 19:27:25:435 RRM_2 [MS->NW] RR__CHANNEL_REQUEST
OTA 1750579 19110347 19:27:26:635 RRM_2 [MS->NW] RR__CHANNEL_REQUEST
OTA 1872436 19126325 19:28:46:525 MM_2 [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)
OTA 1872738 19126327 19:28:46:525 RRM_2 [MS->NW] RR__CHANNEL_REQUEST
OTA 1873274 19126334 19:28:46:525 RRM_2 [MS->NW] RR__CHANNEL_REQUEST
OTA 1873304 19126353 19:28:46:525 RRM_2 [NW->MS] RR__IMMEDIATE_ASSIGNMENT
PS 1873498 19126679 19:28:48:125 LISR2HISR_CTIRQ1 - RRM_2 MSG_ID_LAPDM_RR_REL_IND
MM层的分析：
SIM2原本是camp在HPLMN的2G网络上，但是在19:26:43时间，发生PLMN loss，SIM2从HPLMN上掉网。
之后手机有触发找网流程，但从log来看，并没有扫到HPLMN网络，而唯一的available PLMN是40505，但手机要尝试进行LAU过程时，connection均建不起来，导致LAU abnormal，且后续同样发生PLMN loss现象。
Type Index Time Local Time Module Message Comment Time Different
PS 44424 18742181 18:56:45:810 MM_2 - RAC_2 MSG_ID_GMMREG_ATTACH_CNF 40410 GSM
PS 1656214 19070682 19:24:08:270 EMM - EVAL MSG_ID_EVAL_EMM_ATTACH_CNF 405872
PS 1660072 19072675 19:24:18:275 MM_2 - RAC_2 MSG_ID_GMMREG_ATTACH_CNF 40410 GSM
PS 1732881 19099692 19:26:33:350 MM_2 - RAC_2 MSG_ID_GMMREG_ATTACH_CNF 40410 GSM
PS 1736152 19101613 19:26:42:925 RATCM_2 - MM_2 MSG_ID_MM_RATCM_IDLE_OUT_OF_SERVICE_IND
PS 1736332 19101708 19:26:43:435 RATCM_2 - MM_2 MSG_ID_MM_RATCM_PLMN_LOSS_IND PLMN loss
PS 1736335 19101708 19:26:43:435 MM_2 - NWSEL_2 MSG_ID_NWSEL_MM_PLMN_LOSS_IND
PS 1736339 19101708 19:26:43:435 NWSEL_2 NWSEL_RECOVERY_TIMER_ID Timer starts, period = 20 seconds
PS 1736342 19101708 19:26:43:435 MM_2 - RAC_2 MSG_ID_GMMREG_DETACH_IND
PS 1741055 19105708 19:27:03:405 NWSEL_2 NWSEL_RECOVERY_TIMER_ID Timer expires when current is action NWSEL_COMM_NO_ACTION
PS 1741058 19105708 19:27:03:405 NWSEL_2 [NWSEL] PLMN_SEARCH_LIST_TYPE NWSEL_LIST_AUTO_POWER_ON_RECOVERY
PS 1741059 19105708 19:27:03:405 NWSEL_2 idx 0, 40410f, NWSEL_GSM, NWSEL_NOT_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, KAL_TRUE, KAL_FALSE
PS 1741061 19105708 19:27:03:405 NWSEL_2 [NWSEL] PLMN_SEARCH_INDEX 0, RAT_GSM
PS 1741062 19105708 19:27:03:405 NWSEL_2 - MM_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ
PS 1741619 19105850 19:27:04:150 MM_2 - NWSEL_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF PLMN not found
PS 1741622 19105850 19:27:04:150 NWSEL_2 [NWSEL][Fast Roaming Search]: fullband search request PLMN_SEARCH_INDEX 0, RAT_GSM
PS 1741623 19105850 19:27:04:150 NWSEL_2 - MM_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ
PS 1747960 19109407 19:27:21:750 MM_2 - NWSEL_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF PLMN not found
PS 1747987 19109407 19:27:21:750 NWSEL_2 idx 2, 40505f, NWSEL_GSM, NWSEL_NOT_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, KAL_FALSE, KAL_FALSE
PS 1747989 19109407 19:27:21:750 NWSEL_2 [NWSEL] PLMN_SEARCH_INDEX 2, RAT_GSM
PS 1747990 19109407 19:27:21:750 NWSEL_2 - MM_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ
PS 1748860 19109707 19:27:23:435 MM_2 - NWSEL_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF
PS 1748896 19109707 19:27:23:435 MM_2 - RAC_2 MSG_ID_GMMREG_CELL_INFO_UPDATE_IND 40505 GSM
OTA 1748903 19109707 19:27:23:435 MM_2 [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)
PS 1748904 19109707 19:27:23:435 MM_2 - RATCM_2 MSG_ID_MM_RATCM_CONN_EST_REQ
PS 1752116 19111061 19:27:30:035 RATCM_2 - MM_2 MSG_ID_MM_RATCM_CONN_EST_CNF
PS 1752119 19111061 19:27:30:035 MM_2 RR reject with cause RAND_ACC_FAILURE
OTA 1758644 19111861 19:27:34:115 MM_2 [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)
PS 1758645 19111861 19:27:34:115 MM_2 - RATCM_2 MSG_ID_MM_RATCM_CONN_EST_REQ
PS 1761602 19113246 19:27:41:130 RATCM_2 - MM_2 MSG_ID_MM_RATCM_CONN_EST_CNF
PS 1761605 19113246 19:27:41:130 MM_2 RR reject with cause RAND_ACC_FAILURE
PS 1761614 19113246 19:27:41:130 MM_2 - RAC_2 MSG_ID_GMMREG_ATTACH_CNF
PS 1803912 19116246 19:27:56:010 MM_2 MM_T3211_TIMER_ID Timer expires in state MM_IDLE_ATTEMPTING_TO_UPDATE
OTA 1803914 19116246 19:27:56:010 MM_2 [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)
PS 1803915 19116246 19:27:56:010 MM_2 - RATCM_2 MSG_ID_MM_RATCM_CONN_EST_REQ
PS 1807654 19117587 19:28:02:820 RATCM_2 - MM_2 MSG_ID_MM_RATCM_CONN_EST_CNF
PS 1807657 19117587 19:28:02:820 MM_2 RR reject with cause RAND_ACC_FAILURE
OTA 1827989 19118387 19:28:06:725 MM_2 [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)
PS 1827990 19118387 19:28:06:725 MM_2 - RATCM_2 MSG_ID_MM_RATCM_CONN_EST_REQ
PS 1828002 19118387 19:28:06:725 RATCM_2 - MM_2 MSG_ID_MM_RATCM_CONN_EST_CNF
PS 1828007 19118387 19:28:06:725 MM_2 RR reject with cause RR_NO_SERVICE
PS 1829845 19118511 19:28:07:365 RATCM_2 - MM_2 MSG_ID_MM_RATCM_IDLE_OUT_OF_SERVICE_IND
PS 1829874 19118516 19:28:07:365 RATCM_2 - MM_2 MSG_ID_MM_RATCM_PLMN_LOSS_IND
PS 1829881 19118516 19:28:07:365 NWSEL_2 [NWSEL] PLMN_SEARCH_INDEX 3, RAT_GSM
PS 1829882 19118516 19:28:07:365 NWSEL_2 - MM_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ ANY PLMN search
PS 1837245 19118896 19:28:09:285 MM_2 - NWSEL_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF
PS 1837248 19118896 19:28:09:285 NWSEL_2 NWSEL_RECOVERY_TIMER_ID Timer starts, period = 20 seconds
PS 1866033 19122896 19:28:29:390 NWSEL_2 NWSEL_RECOVERY_TIMER_ID Timer expires when current is action NWSEL_COMM_NO_ACTION
PS 1866037 19122896 19:28:29:390 NWSEL_2 idx 1, 40410f, NWSEL_GSM, NWSEL_NOT_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, KAL_FALSE, KAL_FALSE
PS 1866038 19122896 19:28:29:390 NWSEL_2 [NWSEL] PLMN_SEARCH_INDEX 1, RAT_GSM
PS 1866039 19122896 19:28:29:390 NWSEL_2 - MM_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ
PS 1866258 19122915 19:28:29:390 MM_2 - NWSEL_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF PLMN not found
PS 1866261 19122915 19:28:29:390 NWSEL_2 [NWSEL][Fast Roaming Search]: fullband search request PLMN_SEARCH_INDEX 1, RAT_GSM
PS 1866262 19122915 19:28:29:390 NWSEL_2 - MM_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ
PS 1871586 19126142 19:28:45:590 MM_2 - NWSEL_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF PLMN not found
PS 1871610 19126142 19:28:45:590 NWSEL_2 idx 2, 40505f, NWSEL_GSM, NWSEL_NOT_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, KAL_FALSE, KAL_FALSE
PS 1871612 19126142 19:28:45:590 NWSEL_2 [NWSEL] PLMN_SEARCH_INDEX 2, RAT_GSM
PS 1871613 19126142 19:28:45:590 NWSEL_2 - MM_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ
PS 1872392 19126325 19:28:46:525 MM_2 - NWSEL_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF
PS 1872429 19126325 19:28:46:525 MM_2 - RAC_2 MSG_ID_GMMREG_CELL_INFO_UPDATE_IND 40505 GSM
OTA 1872436 19126325 19:28:46:525 MM_2 [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)
PS 1872437 19126325 19:28:46:525 MM_2 - RATCM_2 MSG_ID_MM_RATCM_CONN_EST_REQ
PS 1885407 19129687 19:29:03:345 MM_2 MM_T3211_TIMER_ID Timer expires in state MM_IDLE_ATTEMPTING_TO_UPDATE
OTA 1885409 19129687 19:29:03:345 MM_2 [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)
PS 1894000 19131829 19:29:14:050 MM_2 MM_T3213_TIMER_ID Timer expires in state MM_IDLE_ATTEMPTING_TO_UPDATE
OTA 1894002 19131829 19:29:14:050 MM_2 [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)
PS 1902019 19133765 19:29:23:720 MM_2 - RAC_2 MSG_ID_GMMREG_CELL_INFO_UPDATE_IND
OTA 1902024 19133765 19:29:23:720 MM_2 [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)
PS 1908981 19135317 19:29:31:485 MM_2 - RAC_2 MSG_ID_GMMREG_CELL_INFO_UPDATE_IND
OTA 1908986 19135317 19:29:31:485 MM_2 [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)
OTA 1910026 19135524 19:29:32:485 MM_2 [NW->MS] MM__LOCATION_UPDATING_REJECT
PS 1910030 19135524 19:29:32:485 MM_2 Location Update is rejected with cause ROAMING_AREA_NOT_ALLOWED
PS 1910795 19135670 19:29:33:085 NWSEL_2 [NWSEL] PLMN_SEARCH_INDEX 3, RAT_GSM
PS 1910796 19135670 19:29:33:085 NWSEL_2 - MM_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ
PS 1917408 19136268 19:29:36:210 MM_2 - NWSEL_2 MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF
三、变换选网模式以及RAU_REJECT导致的掉网
log可以看到有两次掉网， 其中在13:47:33的掉网是由于设置网络模式为3G only，按照设计是会主动detach之后重新搜网注册，所以有短暂的掉网是正常的。
另外在13:46:07掉网是由于收到了RAU reject，之后又重新进行PS attach，这里会请其他模块同事确认一下上报掉网是否正常，谢谢！
OTA 3133396 45380 13:46:07:415 MM [MS->NW] GMM__ROUTING_AREA_UPDATE_REQUEST
OTA 3138520 48248 13:46:21:815 MM [NW->MS] GMM__ROUTING_AREA_UPDATE_REJECT
PS 3138522 48248 13:46:21:815 MM RAU rejected with cause MS_ID_NOT_DERIVED_BY_NW
PS 3138523 48248 13:46:21:815 MM - RAC MSG_ID_GMMREG_NW_REJECT_IND
SYS 3140329 48333 13:46:22:215 NIL [AT_U p23, s14]+CREG: 0,"FFFF","0FFFFFFF",0,0,0
SYS 3132614 45103 13:46:06:015 NIL [AT_I p21, s11]AT+ERAT=6,0
SYS 3252152 62636 13:47:33:820 NIL [AT_I p21, s11]AT+ERAT=1,0
PS 3252237 62636 13:47:33:820 RAC - MM MSG_ID_GMMREG_SET_RAT_MODE_REQ
OTA 3252250 62636 13:47:33:820 MM [MS->NW] GMM__DETACH_REQUEST
OTA 3255962 63128 13:47:36:220 MM [NW->MS] GMM__DETACH_ACCEPT
SYS 3256332 63128 13:47:36:220 NIL [AT_U p18, s8]+CREG: 0,"FFFF","0FFFFFFF",0,0,0
OTA 3263579 63565 13:47:38:430 MM [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)
OTA 3268210 64442 13:47:42:830 MM [NW->MS] MM__LOCATION_UPDATING_ACCEPT
四、MTK平台终端做TAU被#15拒后关掉EUTRAN能力
出现无法注册4G是由于在设置rat mode时detach\ attach 过程出现被网络以NO_SUITABLE_CELL_IN_TA的cause拒绝，这样MTK设计是会将EUTRAN disable掉，而对比机由于没有看到有设置RAT mode，所以没有出现此现象，贵司可以选择不把4G disable，方法如下：
将SBP_ DISABLE_EUTRAN_AFTER_NO_SUITABLE关掉。
1.请将 nvram_data_items.c中此SBP_DISABLE_EUTRAN_AFTER_NO_SUITABLE_做如下修改：
//#if defined(__DISABLE_EUTRAN_AFTER_NO_SUITABLE__)
0x40 |
//#endif
修改为以下：
#if defined(__DISABLE_EUTRAN_AFTER_NO_SUITABLE__)
0x40 |
#endif
2. 在nvram_editor_data_item.h
将NVRAM_EF_SBP_MODEM_CONFIG_LID_VERNO 升级加1，也就是说，
如果原来是：
#define NVRAM_EF_SBP_MODEM_CONFIG_LID_VERNO "000"
将其修改为：
#define NVRAM_EF_SBP_MODEM_CONFIG_LID_VERNO "001"
如果原来是：
#define NVRAM_EF_SBP_MODEM_CONFIG_LID_VERNO "001"
将其修改为：
#define NVRAM_EF_SBP_MODEM_CONFIG_LID_VERNO "002"
请build之后按照FAQ14656 double check option已经打开，然后进行测试。
也可以参考FAQ17855
Eutran Disable due to ATTACH REJECT with Cause #15 (No Suitable cells in Tracking Area)
SYS 3549103 3078590 15:16:22:475 NIL [AT_I p21, s11]AT+ERAT=3,0
SYS 3583971 3079150 15:16:25:230 NIL [AT_I p21, s11]AT+ERAT=3,0
SYS 3667238 3080512 15:16:32:030 NIL [AT_I p21, s11]AT+ERAT=6,0
OTA 3667448 3080512 15:16:32:030 EMM_NASMSG [MS->NW] EMM_Detach_Request(Detach type="MO_EPS_DETACH", switch-off="KAL_FALSE")
OTA 3669080 3080535 15:16:32:030 EMM_NASMSG [NW->MS] EMM_Detach_Accept
OTA 3687684 3080753 15:16:33:230 ERRC_SYS [NW->MS] SystemInformationBlockType1 (EARFCN[6200], PCI[153])
OTA 3690392 3080782 15:16:33:430 EMM_NASMSG [MS->NW] EMM_Attach_Request(EPS attach type="EMM_ATTACH_TYPE_COMBINED_ATTACH")
OTA 3691581 3080797 15:16:33:430 EMM_NASMSG [NW->MS] EMM_Attach_Reject(EMM cause="EMM_CAUSE_NO_SUITABLE_CELL_IN_TA")
在HPLMN上被reject，默认会被禁12小时：
Type Index Time Local Time Module Message Comment Time Different
OTA 3687684 3080753 15:16:33:230 ERRC_SYS [NW->MS] SystemInformationBlockType1 (EARFCN[6200], PCI[153])
OTA 3690392 3080782 15:16:33:430 EMM_NASMSG [MS->NW] EMM_Attach_Request(EPS attach type="EMM_ATTACH_TYPE_COMBINED_ATTACH")
OTA 3691581 3080797 15:16:33:430 EMM_NASMSG [NW->MS] EMM_Attach_Reject(EMM cause="EMM_CAUSE_NO_SUITABLE_CELL_IN_TA")
PS 4839519 3185653 15:25:17:720 NWSEL [NWSEL] NWSEL 62130f is HPLMN
custom_nwsel_config.c
/*************************************************************************
* EUTRAN disable timer for reject cause #15 in HPLMN
*
* For 23G only SIM, UE will be reject with cause #13, #15 in 4G NW.
* To opitimize power consumption, disable EUTRAN in HPLMN if reject cause #13, #15 is received in 4G PLMN.
*************************************************************************/
/* This value is 12 hrs */
const kal_uint32 NWSEL_EUTRAN_DISABLE_FOR_REJ_IN_HPLMN_TIMER_VALUE = KAL_TICKS_1_MIN * 60 * 12;
五、TAU跟新EFloci导致的stk上报问题
如果EF_LOCI更新就会导致这条stk上报，那应该每次位置更新都会上报吧
-->
并不是说只要有EF_LOCI更新就会上报这条STK DISPLAY TEXT（欢迎提示语）
根据以往的处理，注网状态会下发给SIM卡，EF_LOCI文件会更新等会引起卡是否要上报DISPLAY TEXT（欢迎提示语）
但是具体卡是根据什么内容，决定要上报DISPLAY TEXT（欢迎提示语），是由运营商实作卡时决定的。
这次从上下文来看，是MM那边要求更新的EF_LOCI.
1388932, 0, 57413594, 10:26:09:187 2017/03/20, MOD_MM_2, , TRACE_STATE, MM new State: MM_LOCATION_UPDATING_INITIATED
1388935, 0, 57413595, 10:26:09:187 2017/03/20, MOD_MM_2, MOD_SIM_2, PS_SIM_SAP, MSG_ID_SAT_MM_CONNECTION_INFO_IND
1389558, 0, 57417920, 10:26:09:387 2017/03/20, MOD_MM_2, MOD_SIM_2, PS_SIM_SAP, MSG_ID_SIM_AUTHENTICATE_REQ
1390079, 0, 57424788, 10:26:09:793 2017/03/20, MOD_SIM_2, MOD_MM_2, PS_SIM_SAP, MSG_ID_SIM_AUTHENTICATE_CNF
1390082, 0, 57424789, 10:26:09:793 2017/03/20, MOD_MM_2, MOD_SIM_2, PS_SIM_SAP, MSG_ID_SIM_WRITE_REQ
1390235, 0, 57425469, 10:26:09:993 2017/03/20, MOD_SIM_2, , TRACE_INFO, SELECT:FILE_U_KEYS_IDX => 90 00
1390489, 0, 57427269, 10:26:09:993 2017/03/20, MOD_SIM_2, , TRACE_INFO, SELECT:FILE_U_KC_IDX => 90 00
1391609, 0, 57432338, 10:26:10:393 2017/03/20, MOD_SIM_2, , TRACE_INFO, SELECT:FILE_U_LOCI_IDX => 90 00
1391743, 0, 57433733, 10:26:10:393 2017/03/20, MOD_SIM_2, , TRACE_INFO, UPDATE BINARY offset: 0 length: 11 => 91 32
触发上报 DISPLAY TEXT（欢迎提示语）和前一份log一样，都是更新EF_LOCI，具体log如下。
但是这份log中还更新了几次EF_LOCI,其他case没有触发DISPLAY TEXT
就如我们电话沟通的，并不一定只要有更新EF_LOCI就会上报，卡具体是根据什么条件决定是否要上报DISPLAY TEXT（欢迎提示语），由卡来决定。
119870, 0, 187102227, 14:13:17:839 2017/05/08, MOD_EVAL, MOD_SIM, PS_SIM_SAP, MSG_ID_SIM_AUTHENTICATE_REQ
120228, 0, 187109052, 14:13:18:260 2017/05/08, MOD_SIM, MOD_EVAL, PS_SIM_SAP, MSG_ID_SIM_AUTHENTICATE_CNF
121099, 0, 187111370, 14:13:18:461 2017/05/08, MOD_MM, MOD_SIM, PS_SIM_SAP, MSG_ID_SIM_WRITE_REQ
121184, 0, 187111380, 14:13:18:461 2017/05/08, MOD_SIM, , TRACE_GROUP_3, SIM_SELECT : length: 10
121185, 0, 187111380, 14:13:18:461 2017/05/08, MOD_SIM, , TRACE_GROUP_3, APDU_tx 0: 00 A4 08 04 04 7F FF 6F 7E 00 F2 F2 F2 F2 F2 F2
122909, 0, 187112030, 14:13:18:461 2017/05/08, MOD_SIM, , TRACE_INFO, SELECT:FILE_U_LOCI_IDX => 90 00
122911, 0, 187112030, 14:13:18:461 2017/05/08, MOD_SIM, , TRACE_GROUP_3, SIM_UPDATE_BINARY : length: 16
122912, 0, 187112030, 14:13:18:461 2017/05/08, MOD_SIM, , TRACE_GROUP_3, APDU_tx 0: 00 D6 00 00 0B 23 C1 F9 06 64 F0 10 A5 31 00 00
125699, 0, 187113443, 14:13:18:461 2017/05/08, MOD_SIM, , TRACE_INFO, UPDATE BINARY offset: 0 length: 11 => 91 32
125701, 0, 187113443, 14:13:18:461 2017/05/08, MOD_SIM, MOD_MM, PS_SIM_SAP, MSG_ID_SIM_WRITE_CNF
125704, 0, 187113444, 14:13:18:461 2017/05/08, MOD_SIM, , TRACE_GROUP_3, SIM_FETCH : length: 5
125705, 0, 187113444, 14:13:18:461 2017/05/08, MOD_SIM, , TRACE_GROUP_3, APDU_tx 0: 80 12 00 00 32 F2 F2 F2 F2 00 00 0A 32 91 00 00
126203, 0, 187114258, 14:13:18:662 2017/05/08, MOD_SIM, , TRACE_GROUP_3, APDU_rx length: 50
126204, 0, 187114258, 14:13:18:662 2017/05/08, MOD_SIM, , TRACE_GROUP_3, APDU_rx 0: D0 30 81 03 01 21 01 82 02 81 02 0D 25 08 5C 0A
126205, 0, 187114258, 14:13:18:662 2017/05/08, MOD_SIM, , TRACE_GROUP_3, APDU_rx 1: 65 6C 76 84 75 28 62 37 FF 0C 6B 22 8F CE 60 A8
126206, 0, 187114258, 14:13:18:662 2017/05/08, MOD_SIM, , TRACE_GROUP_3, APDU_rx 2: 4F 7F 75 28 4E 2D 56 FD 80 54 90 1A 4E 1A 52 A1
126207, 0, 187114258, 14:13:18:662 2017/05/08, MOD_SIM, , TRACE_GROUP_3, APDU_rx 3: FF 01 F2 F2 F2 F2 00 00 00 00 00 00 00 00 00 00
126209, 0, 187114258, 14:13:18:662 2017/05/08, MOD_SIM, , TRACE_INFO, FETCH 50 bytes => 90 00
126210, 0, 187114258, 14:13:18:662 2017/05/08, MOD_NIL, MOD_SIM, PS_SIM_SAP, MSG_ID_SAT_PROACTIVE_CMD_IND
126211, 0, 187114258, 14:13:18:662 2017/05/08, MOD_SIM, MOD_L4C, PS_SIM_SAP, MSG_ID_SAT_DSPL_TEXT_IND
六、拨打紧急电话导致掉网的问题
根据MTK design，如果2G无法打通紧急号码，会detach后搜索3G ANY PLMN并尝试重拨
Type Index Time Local Time Module Message Comment Time Different
PS 237255 3966062 17:11:25:510 CC - MM MSG_ID_MMCC_START_CALL_REQ
PS 237256 3966062 17:11:25:510 CC - MM MSG_ID_MMCC_EST_REQ
PS 237257 3966062 17:11:25:510 MM ACCESS not allowed in current cell,[Cell class]400,[MS class]200
PS 237258 3966062 17:11:25:510 MM CM service is rejected because of access class not allowed
PS 237259 3966062 17:11:25:510 MM - CC MSG_ID_MMCC_EST_REJ //2G无法拨通
OTA 237628 3966064 17:11:25:510 MM [MS->NW] GMM__DETACH_REQUEST //detach
OTA 241522 3966297 17:11:26:710 MM [NW->MS] GMM__DETACH_ACCEPT //detach完成
PS 246674 3966317 17:11:26:710 NWSEL - MM MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ //搜3G，ANY PLMN
PS 248857 3966410 17:11:27:310 MM - NWSEL MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF //成功
OTA 249082 3966410 17:11:27:310 MM [MS->NW] MM__CM_SERVICE_REQUEST
OTA 250976 3966457 17:11:27:510 ADR [MS->NW] RRC__RRC_CONNECTION_REQUEST
OTA 251419 3966512 17:11:27:710 ADR [MS->NW] RRC__RRC_CONNECTION_SETUP_COMPLETE
OTA 252165 3966586 17:11:28:110 MM [NW->MS] MM__CM_SERVICE_ACCEPT
OTA 252174 3966586 17:11:28:110 CC [MS->NW] CC__EMERGENCY_SETUP //3G上拨打
AP侧UI对应代码逻辑：
目前与statusbar sim卡图标显示相关的文件有：
/frameworks/base/packages/SystemUI/src/com/android/systemui/statusbar/policy/NetworkControllerImpl.java
/frameworks/base/packages/SystemUI/src/com/android/systemui/statusbar/policy/MobileSignalController.java
/frameworks/base/packages/SystemUI/src/com/android/systemui/statusbar/SignalClusterView.java
对于信号强度图标的显示默认的逻辑为：
MobileSignalController.java中如下函数在底层上报信号强度有变化时会被回调
8 public void onSignalStrengthsChanged(SignalStrength signalStrength) {
649 if (DEBUG) {
650 Log.d(mTag, "onSignalStrengthsChanged signalStrength=" + signalStrength +
651 ((signalStrength == null) ? "" : (" level=" + signalStrength.getLevel())));
652 }
653 mSignalStrength = signalStrength;
654 updateTelephony();
655 }
之后通过MobileSignalController.java的updateTelephony来进行相应状态图标的获取及对应状态的更新，updateTelephony的如下代码更新mCurrentState.level
if (mCurrentState.connected) {
543 if (!mSignalStrength.isGsm() && mConfig.alwaysShowCdmaRssi) {
544 mCurrentState.level = mSignalStrength.getCdmaLevel();
545 } else {
546 mCurrentState.level = mSignalStrength.getLevel();
547 }
548 /// M: Customize the signal strength level. @ {
549 mCurrentState.level = mStatusBarExt.getCustomizeSignalStrengthLevel(
550 mCurrentState.level, mSignalStrength, mServiceState);
551 /// @ }
552 }
接着MobileSignalController.java的notifyListeners会被调用，如下获取信号强度的图标：
/// M: Customize the signal strength icon id. @ {
264 int iconId = getCurrentIconId(); //此函数根据level值获取要使用的图标
265 iconId = mStatusBarExt.getCustomizeSignalStrengthIcon(
266 mSubscriptionInfo.getSubscriptionId(),
267 iconId,
268 mSignalStrength,
269 mDataNetType,
270 mServiceState);
最后通过调用SignalClusterView.java的setMobileDataIndicators完全后续显示步骤。
七、显示4G+的问题
AT命令：
这个是AP查询PS能力的：
422681, 0, 225923787, 15:35:27:230 2017/06/10, MOD_NIL, , TRACE_INFO, [AT_U p19, s8]+PSBEARER: 8192,3 //第一个参数8192（16进制的0x2000）代表 L4C_LTE_CA_SUPPORT
466117, 0, 226030575, 15:35:33:922 2017/06/10, MOD_NIL, , TRACE_INFO, [AT_U p19, s8]+PSBEARER: 4096,3 //第一个参数4096（16进制的0x1000）代表 L4C_LTE_SUPPORT
从modem log看档网络配置好scell后，modem会上报8192，当手机回到idle态，或者刚进入连接态还没有配置scell会上报4096
modem逻辑：
手机有时显示4G有时显示4G+是正常的，显示4G+说明手机进入连接态并且配置了辅助小区scell（也就是手机正在使用CA功能）。如果手机回到idle态或网络没有配置scell则手机会显示4G。
您提到的时间点15:50测试机确实没有进入过4G+，因为网络没有配置scell。但没有同一时间段的对比机log所以不清楚是否对比机在不同的小区，网络配置不同。
对比15:35左右的情况，测试机是比对比机进入4G+要多的。
进入4G+的相关log：
在连接态网络可能会发来RRC重配置命令，里面会配置SCELL
OTA (PCORE) 524550 226269543 15:35:49:263 ERRC_SYS [NW->MS] SystemInformationBlockType1 (EARFCN[100], PCI[324])
OTA (PCORE) 527259 226271373 15:35:49:471 ERRC_CONN [NW->MS] ERRC_RRCConnectionReconfiguration(measCfg:[0],mobCtrlInfo:[0],dedInfoNASList:[0],radioresCfgDed:[1],secCfgHO:[0])
PS (PCORE) 527316 226271377 15:35:49:471 ERRC_CHM [CHM] SCell[1] with pci[324] & earfcn[1825] is added in SCell add/mod list //配置了scell
PS (PCORE) 527621 226271515 15:35:49:471 ERRC_MOB [MMC] add SCell, 1st SCell earfcn[1825] pci[324] nw_config[KAL_TRUE]
之后手机手机收到切换命令或收到RRC释放命令，scell会被清除，手机会显示4G。
OTA (PCORE) 559621 226372733 15:35:55:819 ERRC_CONN [NW->MS] ERRC_RRCConnectionReconfiguration(measCfg:[1],mobCtrlInfo:[1],dedInfoNASList:[0],radioresCfgDed:[1],secCfgHO:[1]) //切换
PS (PCORE) 560353 226373029 15:35:55:819 ERRC_MOB [MMC] delete SCell
AP侧逻辑：
默认版本已经在LTEA改成了LTE网络，正常应该是不会显示4G+的。
具体改的代码在如下文件的如下方法。
贵司说是有时候可以显示其4G+，是在哪里进行修改了吗？
/frameworks/base/telephony/java/android/telephony/ServiceState.java
1198 public void setProprietaryDataRadioTechnology(int rt) {
1199 if (rt > ServiceState.RIL_RADIO_TECHNOLOGY_MTK) {
1200 if (DBG) Rlog.d(LOG_TAG, "[ServiceState] setProprietaryDataRadioTechnology =" + rt);
1201 mProprietaryDataRadioTechnology = rt;
1202 //carrier aggregation
1203 if (rt == ServiceState.RIL_RADIO_TECHNOLOGY_LTEA) {
1204 rt = ServiceState.RIL_RADIO_TECHNOLOGY_LTE;
1205 } else {
1206 rt = ServiceState.RIL_RADIO_TECHNOLOGY_HSPAP;
1207 }
1208 } else {
1209 if (DBG) Rlog.d(LOG_TAG, "[ServiceState] setProprietaryDataRadioTechnology=0");
1210 mProprietaryDataRadioTechnology = 0;
1211 }
1212 setRilDataRadioTechnology(rt);
1213 }
八、attach被reject #99
另外被reject之后，按照协议是会把attempt counter置为最大，这样按照MTK的处理会把eutran disable掉，所以之后也没有搜索4G网络。
d) ATTACH REJECT, other EMM cause values than those treated in subclause 5.5.1.2.5, and cases of EMM cause
#22, if considered as abnormal cases according to subclause 5.5.1.2.5
Upon reception of the EMM cause #19 "ESM failure", if the UE is not configured for NAS signalling low
priority, the UE may set the attach attempt counter to 5. If the attach request is neither for emergency bearer
services nor for initiating a PDN connection for emergency bearer services with attach type not set to "EPS
emergency attach", upon reception of the EMM causes #95, #96, #97, #99 and #111 the UE should set the attach
attempt counter to 5.
九、实验卡LAI相同导致未做LU
卡2注册上了是因为SIM卡2中stored LAI 与 ARFCN[1]小区的LAI相同，不会触发LAU过程，就已经注册上了：
Type Index Time Local Time Module Message Comment Time Different
PS 20425 22939 15:24:57:265 RATCM_2 - RRM_2 MSG_ID_RATCM_GAS_PLMN_SEARCH_REQ
PS 20516 22942 15:24:57:265 RRM_2 - MPAL_2 MSG_ID_RR_MPAL_SEARCH_RF_REQ
PS 26072 23083 15:24:58:065 MPAL_2 - RRM_2 MSG_ID_MPAL_RR_SEARCH_RF_CNF
PS 26079 23083 15:24:58:065 RRM_2 [RCS] There are [1] ARFCNs to try
PS 26080 23083 15:24:58:065 RRM_2 [RCS] Sorted power scan list: Index:0 ARFCN:1 POWER:-324
OTA 27199 23150 15:24:58:265 RRM_2 [NW->MS] RR__SI_3 (ARFCN[1], TC[2])
PS 32275 23432 15:24:59:665 RRM_2 [RCS] PLMN search result -> PLMN_FOUND
PS 32276 23432 15:24:59:665 RRM_2 - RATCM_2 MSG_ID_RATCM_GAS_PLMN_SEARCH_CNF
PS 32347 23432 15:24:59:665 RRM_2 [RRM] One equivalent PLMN: 00101f
PS 32371 23432 15:24:59:665 MM_2 Current LAI and stored LAI are same
SYS 32607 23433 15:24:59:865 NIL [AT_U p23, s14]+CREG: 1,"0001","00000001",0,0,0
而卡1中Current LAI and stored LAI are different，所以触发LAU过程，随机接入的过程（RR__CHANNEL_REQUEST发给网络）一直得不到网络的回应导致LAU过程失败，无法注册：
PS 41166 23700 15:25:01:065 RATCM - RRM MSG_ID_RATCM_GAS_PLMN_SEARCH_REQ
PS 41615 23701 15:25:01:065 RRM - MPAL MSG_ID_RR_MPAL_SEARCH_RF_REQ
PS 51310 23842 15:25:01:865 MPAL - RRM MSG_ID_MPAL_RR_SEARCH_RF_CNF
PS 51318 23842 15:25:01:865 RRM [RCS] Sorted power scan list: Index:0 ARFCN:1 POWER:-320
OTA 52685 23903 15:25:02:065 RRM [NW->MS] RR__SI_3 (ARFCN[1], TC[2])
PS 61739 24185 15:25:03:465 RRM - RATCM MSG_ID_RATCM_GAS_PLMN_SEARCH_CNF
PS 61835 24186 15:25:03:465 RRM [RRM] One equivalent PLMN: 00101f
PS 61901 24186 15:25:03:465 MM Cell Change Action Type: MM_LAI_CHANGE
PS 61909 24186 15:25:03:465 MM Current LAI and stored LAI are different
OTA 61922 24187 15:25:03:465 MM [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)
OTA 61958 24187 15:25:03:465 RRM [MS->NW] RR__CHANNEL_REQUEST
OTA 63566 24195 15:25:03:665 RRM [MS->NW] RR__CHANNEL_REQUEST
所以卡1是没有成功随机接入过程，无法判断当前网络是否是正常的
我想请教下，这个SIM卡2中stored LAI是一开机就有吗，比方说关机或者开关飞行模式这些是否会删除这个LAI呢，还是说是因为卡2之前肯定注册成功过所以里面有了这个LAI
答：开机后UE会去search PLMN，之后网络会给回复，在system info 里面会有这个LAI。不一定是注册成功后。
LAI是存储在store LAI list里面。开关机跟飞模都不会清掉。只有UE在注册过程中收到
# 11: (PLMN not allowed);# 2: (IMSI unknown in HLR);
# 3: (Illegal MS); or # 6: (Illegal ME).# 12: (Location Area not allowed);等cause时，会把LAI清掉。
//store LAI list是存储在手机侧还是SIM卡中EFloci文件中，另外如果开关机都不清除，那是否会出现个问题，假如刚开机
终端搜网后发现网络的LAI和手机中存储的LAI一样，然后终端不会去做LU，那么这时网络并不知道终端在哪里，那是否这时候
终端就收不到寻呼了呢？
答：
第一个问题：LAI是存储在SIM卡的EFloci文件。在SIM_ready消息中可以看到。
第二个问题：假设是开关机的情况，终端搜网后发现网络的LAI和手机中存储的LAI一样，终端不会去做LU，但这时候终端会去做IMSI attach 跟网络之间来注册，然后网络会知道UE的注册情况。假设是插拔卡，如本题所示的情况。因为log中没有包含拔卡的log，不清楚拔卡后UE侧的行为是怎么样的。从现有log来看，插入卡2 后，卡2进行search网，发现网络的LAI和手机中存储的LAI一样，没有去做任何注册procedure就直接注册上网了。那假设拔卡的时候卡2没有做detach procedure，那log中的卡2行为就是正常的。如果卡2 做了detach行为，那log中的卡2需要做attach才正常。因此，需要知道拔卡后卡2的行为才能具体判断这次插入卡2后 的驻网行为是否正常。
因此，这题要知道root cause，需要烦请贵司重新提供一份包含拔卡，插卡，驻网成功的完整过程。
卡2 的驻网行为如下：
Type Index Time Local Time Module Message Comment Time Different
PS 893 22353 15:24:54:465 SIM_2 - MM_2 MSG_ID_SIM_ERROR_IND
PS 3353 22479 15:24:55:065 GMSS_2 - NWSEL_2 MSG_ID_GMSS_NWSEL_SIM_READY_REQ
SYS 22682 22969 15:24:57:465 NIL [AT_R p24, s15]+CREG: 3,2,"FFFF","0FFFFFFF",0,0,0
PS 32339 23432 15:24:59:665 RATCM_2 - MM_2 MSG_ID_MM_RATCM_PLMN_SEARCH_CNF
PS 32340 23432 15:24:59:665 RATCM_2 - MM_2 MSG_ID_MM_RATCM_SYS_INFO_IND
PS 32371 23432 15:24:59:665 MM_2 Current LAI and stored LAI are same
PS 32373 23432 15:24:59:665 MM_2 - RAC_2 MSG_ID_GMMREG_ATTACH_CNF
PS 32389 23432 15:24:59:665 MM_2 - NWSEL_2 MSG_ID_NWSEL_MM_REGN_RESULT_IND
PS 32394 23432 15:24:59:665 NWSEL_2 [NWSEL] NWSEL_MM_PROC_LU LR_ACCEPT CAUSE_NONE
SYS 32607 23433 15:24:59:865 NIL [AT_U p23, s14]+CREG: 1,"0001","00000001",0,0,0
十、4G下attach被拒一直显示3G
从目前的log来看，开机后4G attach过程被reject，原因是因为ESM FAILURE，手机收到该原因的rejection，会先把该PLMN的4G功能disable，并起EUTRAN_DISABLE_TIMER，只有当定时器超时后才会重新enable该PLMN的4G功能。
请问问题复现概率有多高？
是否可以帮忙提供开机可以正常camp联通4G的包括开机过程的log以便能进行对比分析？
目前提供的对比机log没有开机过程，所以无法对比确认attach过程的参数是否有差别。
Thanks
Type Index Time Local Time Module Message Comment Time Different
PS 27122 1731 08:02:27:850 SIM - GMSS MSG_ID_SIM_GMSS_READY_IND 46001
SYS 78679 4467 08:02:41:450 NIL [AT_I p21, s11]AT+CGDCONT=0,"IPV4V6","3gnet",,0,0,0,0,1,0
PS 79948 4482 08:02:41:650 NWSEL idx 0, 46001f, NWSEL_TD_FDD_LTE, NWSEL_NOT_SEARCHED, NWSEL_UMTS, NWSEL_NOT_SEARCHED, NWSEL_GSM, NWSEL_NOT_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, KAL_TRUE, KAL_FALSE
PS 79950 4482 08:02:41:650 NWSEL [NWSEL] PLMN_SEARCH_INDEX 0, RAT_LTE
PS 79951 4482 08:02:41:650 NWSEL - EVAL MSG_ID_NWSEL_EVAL_PLMN_SEARCH_REQ
PS 85167 4544 08:02:41:850 EVAL - NWSEL MSG_ID_NWSEL_EVAL_PLMN_SEARCH_CNF
OTA 101906 4915 08:02:43:850 ESM [MS->NW] ESM_MSG_PDN_CONNECTIVITY_REQUEST (PTI:1, EBI:0)
OTA 104189 4926 08:02:43:850 EMM_NASMSG [MS->NW] EMM_Attach_Request(EPS attach type="EMM_ATTACH_TYPE_COMBINED_ATTACH")
OTA 110625 5001 08:02:44:250 ESM [MS->NW] ESM_MSG_ESM_INFORMATION_RESPONSE (PTI:1, EBI:0) APN: 3gnet
OTA 111890 5015 08:02:44:250 EMM_NASMSG [NW->MS] EMM_Attach_Reject(EMM cause="EMM_CAUSE_ESM_FAILURE")
OTA 112032 5015 08:02:44:250 ESM [NW->MS] ESM_MSG_PDN_CONNECTIVITY_REJECT (PTI:1, EBI:0, ESM cause:"ESM_CAUSE_USER_AUTH_FAILED")
PS 112042 5015 08:02:44:250 EMM_REG [EMM REG] Set attach attempt count to MAX
PS 112338 5016 08:02:44:250 NWSEL PLMN 46001f is in EUTRAN disabled list, cause: CS - NWSEL_REJ_CAUSE_CS_ABNORMAL; PS - NWSEL_REJ_CAUSE_PS_ABNORMAL
PS 112340 5016 08:02:44:250 NWSEL NWSEL_EUTRAN_DISABLE_TIMER_ID Timer starts, period = 720 seconds
PS 112341 5016 08:02:44:250 NWSEL [NWSEL] PLMN_SEARCH_INDEX 0, RAT_UMTS
PS 1267663 149016 08:14:44:350 NWSEL NWSEL_EUTRAN_DISABLE_TIMER_ID Timer expires when current is action NWSEL_COMM_NO_ACTION
PS 1267667 149016 08:14:44:350 NWSEL - MM MSG_ID_NWSEL_MM_EUTRAN_CAP_UPDATE_REQ EUTRAN_ENABLED
OTA 1282030 150666 08:14:52:510 EMM_NASMSG [MS->NW] EMM_Tracking_Area_Update_Request(EPS update type="EMM_UPDATE_TYPE_COMBINED_TAU_IMSI_ATTACH", active flag="KAL_FALSE")
OTA 1287381 150747 08:14:52:910 EMM_NASMSG [NW->MS] EMM_Tracking_Area_Update_Accept(EPS update result="EMM_UPDATE_RESULT_COMBINED_UPDATED")
OTA 1287564 150747 08:14:52:910 EMM_NASMSG [MS->NW] EMM_Tracking_Area_Update_Complete
十一、4G下attach被拒导致将TA加入禁止列表
此问题是网络发来detach request,导致手机将当前的TA加入到禁止TA list,而手机当时只能搜到这一个TA的小区，所以之后一直无法选到可用4G小区无法正常服务。
OTA (PCORE) 317209 45018082 10:40:45:142 EMM_NASMSG [NW->MS] EMM_Detach_Request(Detach type="MT_REATTACH_NOT_REQUIRED", EMM cause="EMM_CAUSE_NO_EPS_CTXT_ACT")
OTA (PCORE) 317283 45018088 10:40:45:142 EMM_NASMSG [MS->NW] EMM_Detach_Accept
PS (PCORE) 319121 45018422 10:40:45:142 EMM_REG [EMM REG] Complete NW detach with re-attach not required (cause 40)
PS (PCORE) 319130 45018423 10:40:45:142 EMM_REG [EMM REG] Add current TAI to FTAI list for roaming //加入禁止TA
PS (PCORE) 326719 45022875 10:40:45:344 ERRC_CEL [CEL_DI/LV] cell failed: earfcn[1825]/pci[166], fail[ERRC_CEL_TRACE_DI_JUDGE] //选择小区一直失败，因为当前TA不能驻留
PS (PCORE) 329413 45024749 10:40:45:544 ERRC_CEL [CEL_DI/LV] cell failed: earfcn[100]/pci[465], fail[ERRC_CEL_TRACE_DI_JUDGE]
PS (PCORE) 332661 45030942 10:40:45:988 ERRC_CEL [CEL_DI/LV] cell failed: earfcn[1825]/pci[324], fail[ERRC_CEL_TRACE_DI_JUDGE]
十二、4G小区重选
如何确认终端当时是驻留在4G还是其他RAT上
可以查看PS Trace peer看当前打印的OTA日志是4G的还是2G的。
或者从System Trace里面看CGREG
Type Index Time Local Time Module Message Comment Time Different
SYS (PCORE) 30552 424833 09:51:58:678 NIL [AT_R p20, s9]+CGREG: 3,1,"2805","02E1ED15",7,"00",0,0
=> Decode:GPRS network registration status +CGREG
SYS (PCORE) 532275 3732600 09:55:30:328 NIL [AT_R p20, s9]+CGREG: 3,4,"2805","00007113",3,"01",0,0
=> Decode:GPRS network registration status +CGREG
----------------------------------------------------------
终端开始发生重选有对应的打印：Cell reselection procedure starts
----------------------------------------------------------
看终端当前驻留在哪个小区上
可以看下面关键信息，如果一直在4G上，比如09:51:59到09：52：19就在38400/360上，
Type Index Time Local Time Module Message Comment Time Different
PS (PCORE) 38843 443753 09:51:59:896 ERRC_CEL [CEL_DI/LV] cell camp on as serving: earfcn[38400]/pci[360], is_csg_cell[KAL_FALSE]
PS (PCORE) 127049 742402 09:52:19:013 ERRC_CEL [CEL_DI/LV] cell camp on as serving: earfcn[38400]/pci[340], is_csg_cell[KAL_FALSE]
PS (PCORE) 134126 747434 09:52:19:225 ERRC_CEL [CEL_DI/LV] cell camp on as serving: earfcn[38400]/pci[340], is_csg_cell[KAL_FALSE]
PS (PCORE) 137080 756150 09:52:19:851 ERRC_CEL [CEL_DI/LV] cell camp on as serving: earfcn[38400]/pci[340], is_csg_cell[KAL_FALSE]
PS (PCORE) 210136 930246 09:52:30:849 ERRC_CEL [CEL_DI/LV] cell camp on as serving: earfcn[38400]/pci[340], is_csg_cell[KAL_FALSE]
PS (PCORE) 214229 959848 09:52:32:900 ERRC_CEL [CEL_DI/LV] cell camp on as serving: earfcn[37900]/pci[309], is_csg_cell[KAL_FALSE]