MTK modemlog分析
Call流程
无论是在CS还是ims域看掉话问题首先先分析是否校准以及写入IMEI号
在 kernel-3.18及其以前的老平台中可以通过随机接入来分析DUT是否有校准，如果信号还算良好，但频繁随机接入失败。那么可能是没有校准或rf参数本身有问题。
典型log如下
1403508, 947548, 884529, 18:05:45:610 2018/02/27, MOD_UMAC, , TRACE_INFO, rachSuccess = 0, rachFail = 1
1404675, 947836, 884795, 18:05:46:810 2018/02/27, MOD_UMAC, , TRACE_INFO, rachSuccess = 0, rachFail = 2
1405841, 948118, 885055, 18:05:48:210 2018/02/27, MOD_UMAC, , TRACE_INFO, rachSuccess = 0, rachFail = 3
1409412, 948410, 885325, 18:05:49:610 2018/02/27, MOD_UMAC, , TRACE_INFO, rachSuccess = 0, rachFail = 4
1410642, 948696, 885589, 18:05:50:810 2018/02/27, MOD_UMAC, , TRACE_INFO, rachSuccess = 0, rachFail = 5
在kernel-4.4的新平台中，可通过如下log判断DUT是否校准
500119, 12125, 1256221, 16:46:43:794 2017/12/27, MOD_NIL, , TRACE_INFO, 4G calibration is not performed or the calibration data is not downloaded !!!
500134, 12125, 1256221, 16:46:43:794 2017/12/27, MOD_NIL, , TRACE_INFO, 2G calibration is not performed or the calibration data is not downloaded !!!
500135, 12125, 1256221, 16:46:43:794 2017/12/27, MOD_NIL, , TRACE_INFO, 3G calibration is not performed or the calibration data is not downloaded !!!
GPRS会发起鉴权要求UE提供IMEI号以验证UE是否合法，如果没有合法IMEI号会被网络拒绝接入,会无服务或者掉话
GPRS鉴权被拒，例如：
从mdlog的system trace里查看到没写入IMEI,
Message: IMEI of SIM1:ffffffffffffff0
在mdlog的Trace peer window查看到GPRS鉴权时被拒
MOD_MM TRACE_PEER [NW->MS] GMM__AUTHENTICATION_AND_CIPHERING_REJ
2 写了IMEI，但是不合法，在Location update时被网络以Illegal ME拒绝，
Frame #: Time: 939835 Local Time: 14:37:43:719 2014/09/11 Message: IMEI of SIM1:865627022306010
2273 Trace 940141 14:37:45:131 2014/09/11 MOD_MM TRACE_PEER [NW->MS] MM__LOCATION_UPDATING_REJECT
2275 Trace 940141 14:37:45:131 2014/09/11 MOD_MM TRACE_INFO Location Update is rejected with cause ILLEGAL_ME
在校准和imei号都ok后，在开始分析流程，主要分析OTA messages
2G/3Gcall总体流程
MOC流程（MIC类似）
Step1 ：CM service request //call请求
Step2 ：RA and immediate assignment //随机接入。立即指派
Step3 ：MM connection setup //mm连接建立
Step4 ：MM assignment for MOC//RR分配
具体log流程
mo call流程
[MS->NW] MM__CM_SERVICE_REQUEST //申请call请求
[NW->MS] RR__IMMEDIATE_ASSIGNMEN
[MS->NW] RR_CHANNEL_REQUEST
[MS->NW] CC__SETUP
[NW->MS] CC__CALL_PROCEEDING//网络对端收到paging
[NW->MS] CC__ALERTING //收到对端铃声
[NW->MS] CC__CONNECT
[MS->NW] CC__CONNECT_ACKNOWLEDGE
MT call
[MS->NW] RR__PAGING_RESPONSE
[NW->MS] RR__IMMEDIATE_ASSIGNMENT
[NW->MS] CC__SETUP
[MS->NW] CC__CALL_CONFIRMED
[MS->NW] CC__ALERTING//向对端发起铃声
[MS->NW] CC__CONNECT
[NW->MS] CC__CONNECT_ACKNOWLEDGE
主动挂断流程
[MS->NW] CC__DISCONNECT
[NW->MS] CC__RELEASE
[MS->NW] CC__RELEASE_COMPLET
Calldrop常见原因
若是在CC__CONNECT后异常calldrop需要确定在以上流程哪个步骤出现异常。
首先应该check是否收到NW下发的CC__DISCONNECT，如果有收到，很可能是对端或者网络问题
之后就需要看nw下发的CC__DISCONNECT带的cause_value 是多少来确定挂断原因，进一步分析对端log。详细的cause_value含义可以参考以下文档
https://wenku.baidu.com/view/2c6dc83b31126edb6f1a106b.html
如果没有收到CC__DISCONNECT那么需要check call中断的地方，即不在上报[MS->NW] RR__MEASUREMENT_REPORT的时间节点附近的PS integreted
首先可以看MAX RLC: 64 CURRENT RLC: 0 如果max rlc不等于current rlc说明网络丢包，当current rlc减小到10以下就很容易掉话
掉话原因可以查看MSG_ID_LAPDM_RR_ERROR_IND附带的error_cause
具体的error_cause可在百度中找到，通常掉话原因都是以下两种cause
error_cause = ERROR_TIMER_EXPD_N200_ABNORMAL_REL (enum 2)
error_cause = ERROR_RADIO_LINK_FAILURE (enum 19)
第一个cause是N200定时器超时，即UE多次回复RR__MEASUREMENT_REPORT，NW不会因
第二个cause是radio link fail主要体现在RLC丢包
造成以上两个原因基本上都是信号质量不好造成的，可以看MSG_ID_MPAL_RR_SERV_DEDI_MEAS_IND信令中附带的
rlac_sub_in_quarter_dbm = 0xfeab，信号强度
rxqual_sub_avg = 0x07信号质量，0最优，7最差
小区切换fail引起的 calldrop或者通话无声问题
通常可以看到信号质量rxqual_sub_avg 在5或5以上（除了7，7可能就直接掉了）网络会要求UE切换小区，下发RR__HANDOVER_COMMAND
[RMC] Target_arfcn = 656, F_O = 1169239, E_O = 7924
MSG_ID_MPAL_RR_HANDOVER_FAIL_IND
MSG_ID_RR_LAPDM_RECON_REQ
T3124计时器超时，因为信号质量已经太差了，比如在车上，网络在5的时候发起handover，真正 还是的时候，信号质量已经7了。之后UE通常会请求重新驻网会原来小区
[MS->NW] RR__HANDOVER_FAILURE Abnormal release, timer expired (3)
如果成功回去，那么这就是一个NW引起的通话无声问题通话
如果回不去了，那么就是一个NW引起的掉话问题
信号质量差，去寻找能驻留的小区，但是发现没有适合的小区造成的掉话
[MS->NW] RR__MEASUREMENT_REPORT
MSG_ID_LAPDM_RR_ERROR_IND
//信号质量差导致Radio Link Failure错误
MSG_ID_LAPDM_RR_ERROR_IND
//channel断开
RRM - MPAL MSG_ID_RR_MPAL_DEDICATED_CHANNEL_DISCONNECT_REQ
MPAL - RRM MSG_ID_MPAL_RR_DEDICATED_CHANNEL_DISCONNECT_CNF
RRM - RATCM MSG_ID_RATCM_GAS_CONN_LOSS_IND
RRM [RMC] Radio Link Trigger reselection!
RATCM - MM MSG_ID_MM_RATCM_CONN_LOSS_IND
MM CM rej because RADIO LINK FAILURE
//尝试重建call
MM_WAIT_FOR_REESTABLISH
CC ENTER RE-ESTABLISHMENT MODE
RRM [NW->MS] RR__SI_2 (ARFCN[123], TC[1])
[NW->MS] RR__SI_2 (ARFCN[648], TC[1])
[NW->MS] RR__SI_2TER (ARFCN[120], TC[5])
[NW->MS] RR__SI_4 (ARFCN[118], TC[7])
[NW->MS] RR__SI_2 (ARFCN[118], TC[1])
//没有合适小区进行重建call，放弃重建，报告通话中断。
MM_IDLE_NO_CELL_AVAILABLE
MSG_ID_MNCC_REL_CNF
MSG_ID_L4CCSM_CC_ABORT_CALL_REQ
若是call杂音断续等问题，可以听vmlog来check是声音否有问题，同时从RLC是否有丢包两点来analyse是audio 还是modem的问题 。
若发现是上述原因掉话，需要确定对比机是否pass，如果对比机pass，那么看对比机和问题机是否在同一个arfcn，如果在同一个arfcn，需要请rf部门同事确认天线及其rf性能为何不如对比机。若发现不在同一个arfcn，需要check全部的arfcn，看看我们的机器所有小区的信号和对比机有什么区别，来做具体分析,具体log可以看，[RMC][MR][2G]: NCEEL Report[0] -> arfcn[108], rla[-374]，通常是一次测5个最好的小区。
长时间挂不掉call
主动挂断ue发出CC__ALERTING，但是网络没有下发[NW->MS] CC__CONNECT_ACKNOWLEDGE造成的长时间挂不掉电话，体现在一直卡在拨号界面显示正在挂断
之前见过的是在MSG_ID_LAPDM_RR_ERROR_IND中有附带
ERROR_TIMER_EXPD_N200_ABNORMAL_REL
Call fail常见问题
主要看挂在在哪个步骤上
没有发起1CSFB后立刻fail
//下paging
[NW->MS] PAGING,
PagingRecordList[KAL_TRUE], SIB Modification[KAL_FALSE], ETWS[KAL_FALSE], CMAS[KAL_FALSE]
CS的paging
ERRC_CEL [CEL_DI/LV] send PAGING_IND to EMM on [ENASAS_CN_DOMAIN_CS] with STMSI(mmec/mtmsi)[164/236,140,61,5]
PS 1546786 487939 14:53:13:455 EMM_ERRCIF [EMM ERRCIF] Receive CS STMSI paging
那么CSFB到2G
[MS->NW] EMM_
_Service_Request(service type=“MT_CSFB”, CSFB response=“CSFB_ACCEPTED_BY_UE”)
RRM [MS->NW] RR__PAGING_RESPONSE
RRM [NW->MS] RR__SI_6 (ARFCN[76], TC[255])
RRM [MS->NW] RR__MEASUREMENT_REPORT
发生了N200错误
RRM MSG_ID_LAPDM_RR_ERROR_IND
error_cause = ERROR_TIMER_EXPD_N200_ABNORMAL_REL (enum 2)
有发起1、[MS->NW] MM__CM_SERVICE_REQUEST
但是没有收到nw的[NW->MS] RR__IMMEDIATE_ASSIGNMEN后来被UE主动释放
[MS->NW] RRC__SIGNALLING_CONNECTION_RELEASE_INDICATION
如果频繁发生在此阶段，信号频繁变化，那么可能需要检查rf参数RX配置是否有问题，如果信号稳定，那么可能需要检查rf参数TX是否有问题，如果偶先，可能是nw问题
如果收到[NW->MS] RR__IMMEDIATE_ASSIGNMEN随后收到网络下发[NW->MS] MM__ABORT，那么可能是MT的问题，需要check MT
如果在收到[NW->MS] CC__CALL_PROCEEDING，[NW->MS] CC__ALERTING之后挂断，那么同样也需要check对端，因为如果对端有问题，UE这边可能会收到，您所拨打的电话…之类的
如果刚一接听就自动挂断，MO,MT都收到网络下发的CC__DISCONNECT，那么需要具体看其带的cause_value，目前有见过最多的value是44，如果不是很频繁，通常是网络异常；如果很频繁需要check ANT性能
关于何时下paging，合适进入active？
具体call AP和modem的状态同步，即什么时候进入active，什么时候进入idle，需要查看3GPP 24.008，百度3GPP可以自行下载
关于paging类型，何时下paging，在25.331中有详细介绍
4G call流程
[MRM] store scell: earfcn[37900] pci[87] rsrp[-433] rsrq[-50] cell_off[0] cell_state[0]
[MRM] store scell: earfcn[37900] pci[87] rsrp[-433] rsrq[-49] cell_off[0] cell_state[0]
PS域属于业务相关的paging
OTA 1603090 493571 14:53:41:615 ERRC_CEL [NW->MS] PAGING, PagingRecordList[KAL_TRUE], SIB Modification[KAL_FALSE], ETWS[KAL_FALSE], CMAS[KAL_FALSE]
PS 1603102 493571 14:53:41:615 ERRC_CEL [PAGING] Rx Paging for UE with S-TMSI: mmec[10100100b], m-tmsi:[11101100b 10001110b 00111101b 00000101b]
PS 1603103 493571 14:53:41:615 ERRC_CEL [PAGING] ueid matched?[KAL_TRUE]: sim_status[ENASAS_SIM_VALID], ueid sel[PagingUE_Identity_s_TMSI_selected], stmsi_valid in SIM[KAL_TRUE]
PS 1603104 493571 14:53:41:615 ERRC_CEL [CEL_DI/LV] send PAGING_IND to EMM on [ENASAS_CN_DOMAIN_PS] with STMSI(mmec/mtmsi)[164/236,142,61,5]
PS 1603105 493571 14:53:41:615 ERRC - EMM MSG_ID_EMM_ERRC_PAGE_IND
完成PS域相关的网络需要
OTA 1603727 493576 14:53:41:615 ERRC_CONN [MS->NW] ERRC_RRCConnectionRequest
PS 1609305 493633 14:53:41:815 ERRC_MOB [MRM] store scell: earfcn[37900] pci[87] rsrp[-438] rsrq[-52] cell_off[0] cell_state[0]
一通call是否成功,通常会去看183以及200ok是否正常
SYS (PCORE) 210267 655146 11:00:49:532 NIL [AT_U p19, s8]+ESIPCPI: 0,1,0,1,0,""
SYS (PCORE) 210790 655724 11:00:49:732 NIL [AT_U p19, s8]+ESIPCPI: 1,0,1,1,183,""
OTA (PCORE) 212078 657976 11:00:49:732 ESM [NW->MS] ESM_MSG_ACTIVATE_DEDICATED_EPS_BEARER_CONTEXT_REQUEST (PTI:0, EBI:7)
OTA (PCORE) 212361 657990 11:00:49:732 ESM [MS->NW] ESM_MSG_ACTIVATE_DEDICATED_EPS_BEARER_CONTEXT_ACCEPT (PTI:0, EBI:7)
SYS (PCORE) 216163 664276 11:00:50:132 NIL [AT_U p19, s8]+ESIPCPI: 1,0,1,1,180,""
SIP 16 745658 11:00:55:412 [NW->MS]CANCEL sip:[2409:8809:8590:4A4A:C376:9C50:8235:1D8A]:50028 SIP/2.0
SYS (PCORE) 229629 745666 11:00:55:412 NIL [AT_U p19, s8]+ESIPCPI: 1,1,0,4,0,""
SYS (PCORE) 229692 745807 11:00:55:412 NIL [AT_U p19, s8]+ESIPCPI: 1,0,1,4,200,""
SYS (PCORE) 229721 745816 11:00:55:412 NIL [AT_U p19, s8]+ESIPCPI: 1,0,1,1,487,""
OTA (PCORE) 231018 746738 11:00:55:412 ESM [NW->MS] ESM_MSG_DEACTIVATE_EPS_BEARER_CONTEXT_REQUEST (PTI:0, EBI:7)
OTA (PCORE) 231067 746742 11:00:55:412 ESM [MS->NW] ESM_MSG_DEACTIVATE_EPS_BEARER_CONTEXT_ACCEPT (PTI:0, EBI:7)
期间主要是通过ECPI这条AT来看这通call，通话过程中的情况，已经挂断情况
Sim卡流程浅析
Sim card
Step 1：fetch sim record
Line 26574: 09-13 15:50:31.196439 1859 1859 D SIMRecords: [SIMRecords] fetchSimRecords 0 (slot 0)
Line 27143: 09-13 15:50:31.229080 1859 1859 D SIMRecords: [SIMRecords] fetchSimRecords 18 requested: true (slot 0)
Line 27550: 09-13 15:50:31.260930 1859 1859 D SIMRecords: [SIMRecords] fetchSimRecords 0
(slot 1)
Line 28364: 09-13 15:50:31.304495 1859 1859 D SIMRecords: [SIMRecords]fetchSimRecords 18 requested: true (slot 1)
Line 41921: 09-13 15:50:34.155782 1859 1859 D SIMRecords: [SIMRecords] record load complete (slot 0)
Line 48017: 09-13 15:50:37.054278 1859 1859 D SIMRecords: [SIMRecords] record load complete (slot 1)
Step 2：AT command
The information contained in this document can be modified without notice.
12.5 AT+ES3G – Switch 3G Service
12.5.1 Description
This command is used to set the mapping between 3G capability of the protocol and
physical SIM
12.5.2 Format
Command Possible response(s)
+ES3G=[, ]
+CME ERROR:
+ES3G? +ES3G:
+CME ERROR:
12.5.3 Field
: a bit mask value. Each bit corresponding to a physical SIM. This value is
used to indicate that which SIM has the 3G capability. Since we could only support one
SIM to use the 3G capability, only the following values are valid.
1: SIM1
2: SIM2
4: SIM3
8: SIM4
: The network RAT mode after switching. The valid values are as follows.
1: GSM
2: UMTS
3: Dual Mode (GSM and UMTS)
If this value is omitted, the default value is “Dual Mode”
// sim2 set up menu.
04-24 17:52:24.846435 1212 1244 D AT : RIL_URC2_READER Enter processLine:+STKPCI: 0,“D06E810301250082028182050F80005500530049004D53615E9475288F0A01806211768454C1724C8F0A0280670D52A152A974068F0A038065E07EBF57CE5E028F0A048079FB52A87CBE54C18F0A05804E1A52A18D855E028F0A4C805E9475287BA174068F0A4D804E0B8F7D8BBE7F6E”
Sim卡识卡（上报display text）Log位置 radio log
04-21 10:12:03.093014 1049 1081 D AT : RIL_URC2_READER Enter processLine:+STKPCI: 0,“D0308103012101820281028D25085C0A656C76845BA26237FF1A611F8C2260A8900962E94E2D56FD79FB52A8901A4FE1FF01”
Simcard plug out, then plug in.
04-24 17:52:46.985221 1212 1244 D AT : RIL_URC2_READER Enter processLine:+ESIMS: 0,11
04-24 17:53:05.162342 1212 1238 D AT : RIL_URC_READER Enter processLine:+ESIMS: 1,12
04-24 17:53:05.163626 1212 1244 D AT : RIL_URC2_READER Enter processLine:+ESIMS: 1,12
+ESIMS:
0 SIM not presented
1 SIM presented
: integer
0 SIM_CARD_REMOVED,
1 SIM_ACCESS_ERROR,
2 SIM Refresh
3 // Reserved for other use
MEDIATEK CONFIDENTIAL
4 // Reserved for other use
5 SIM_ACCESS_PROFILE_ON
6 SIM_ACCESS_PROFILE_OFF
7 DUALSIM_DISCONNECTED
8 DUALSIM_CONNECTED
9 SIM_VSIM_ON
10 SIM_VSIM_OFF
11 SIM_PLUG_OUT
12 SIM_PLUG_IN
13 SIM_RECOVERY_START
14 SIM_RECOVERY_END
15 SIM_IMEI_LOCK_FAIL
16 SIM_OP09_LOCK_FAIL
Line 42: 12-21 17:57:11.998423 1410 1410 D SubscriptionController: [getPhoneId] asked for default subId=1 带卡log
12-20 20:32:20.192271 1407 1432 D SubscriptionController: [getPhoneId]- no sims, returning default phoneId=2147483647, subId1 不带卡
Modem侧Sim中断
EINT: MD1_SIM2_HOT_PLUG_EINT
MSG_ID_SIM_PLUG_OUT_IND
MSG_ID_SIM_PLUG_IND_IND
一些常用AT
具体详细内容需要查看MTK的AT_DICUMENT_Modem，以下列举常用的AT方便便于查看问题
ECSQ 查看信号强度
COPS可以用来查看是什么运营商
CREG，查看驻网情况，是否驻上网，是否带定位
EAIC 4G call AP发起建立通话
ECPI 4G call通话是附带的信令如
ECPI: 1,0,0,1,1,20,“13510456281”,129,"tel:13510456281;noa=subscriber;srvattri=national;phone-context=+86为请求升级为视频通话
AT+CLCC 发起call
AT+CHLD 主动挂断call，通常可作为是否是用户主动挂断的
AT+CDV，电信卡发起call
ETS Id=CP Spy, SpyId=CP IOP ATC recvd data, Data=+CEND:10电信卡挂断call
rxPwrFilt可以认为是rssi即信号强度
band对应的频点
GSM:
band900：0～124，975～1023
band1800：512～885
band1900：512～810
band850：128～251
UTRAN TD-SCDMA:
Band A: 10054~10121
Band E: 11504~11996
Band F: 9404~9596
UTRAN FDD:
Band 1: 10562~10838
band 2: 9662 ~ 9938, 412, 437, 462, 487, 512, 537, 562, 587, 612, 637, 662, 687
band 3: 1162 ~ 1513
band 4: 1537 ~ 1738, 1887, 1912, 1937, 1962, 1987, 2012, 2037, 2062, 2087
band 5: 4357 ~ 4458, 1007, 1012, 1032, 1037, 1062, 1087
band 6: 4387 ~ 4413, 1037, 1062
band 7: 2237 ~ 2563, 2587, 2612, 2637, 2662, 2687, 2712, 2737, 2762, 2787, 2812,
2837, 2862, 2887, 2912
band 8: 2937 ~ 3088
band 9: 9237 ~ 9387
band 10: 3112 ~ 3388, 3412, 3437, 3462, 3487, 3512, 3537, 3562, 3587, 3612, 3637,
3662, 3687
band 11: 3712 ~ 3787
band 12: 3842 ~ 3903, 3932, 3957, 3962, 3987, 3992
band 13: 4017 ~ 4043, 4067, 4092
band 14: 4117 ~ 4143, 4167, 4192
band 15: reserved
band 16: reserved
band 17: reserved
band 18: reserved
band 19: 712 ~ 763, 787, 812, 837
band 20: 4512 ~ 4638
band 21: 862 ~ 912
band 22: 4662 ~ 5038
LTE:
0~46589, if not supported, modem will ignore
FDD:
Band 1: 0~599
Band 2: 600~1199
Band 3: 1200~1949
Band 4: 1950~2399
Band 5: 2400~2649
Band 6: 2650~2749
Band 7: 2750~3449
Band 8: 3450~3799
Band 9: 3800~4149
Band10: 4150~4749
Band11: 4750~4949
Band12: 5010~5179
Band13: 5180~5279
Band14: 5280~5379
Band17: 5730~5849
Band18: 5850~5999
Band19: 6000~6149
Band20: 6150~6449
Band21: 6450~6599
Band22: 6600~7399
Band23: 7500~7699
Band24: 7700~8039
Band25: 8040~8699
Band26: 8690~9039
Band27: 9040~9209
Band28: 9210~9659
Band29: 9660~9769
Band30: 9770~9869
Band31: 9870~9919
Band32: 9920~10359
TDD:
Band11: 4750~4949
Band12: 5010~5179
Band13: 5180~5279
Band14: 5280~5379
Band17: 5730~5849
Band18: 5850~5999
Band19: 6000~6149
Band20: 6150~6449
Band21: 6450~6599
Band22: 6600~7399
Band23: 7500~7699
Band24: 7700~8039
Band25: 8040~8699
Band26: 8690~9039
Band27: 9040~9209
Band28: 9210~9659
Band29: 9660~9769
Band30: 9770~9869
Band31: 9870~9919
Band32: 9920~10359
TDD:
Band33: 36000~36199
Band34: 36200~36349
Band35: 36350~36949
Band36: 36950~37549
Band37: 37550~37749
Band38: 37750~38249
Band39: 38250~38649
Band40: 38650~39649
Band41: 39650~41589
Band42: 41590~43589
Band43: 43590~45589
Band44: 45590~46589