關於搜網的故障實例

AT+CREG

PLMN_SEARCH

1、顯示搜不到網
看到08:59:49.354842時間點RIL_CMD_PROXY_3發現請求列表沒有request因而一直sleep：
12-17 08:59:49.350004 12091 12103 D RILC-MTK: proxyLoop free pRI=0xb41d8200 p=0xb61f90a0
12-17 08:59:49.350036 12091 12103 D RILC-MTK: proxyLoop free pRequest=0xb41d4500
12-17 08:59:49.350063 12091 12103 D RILC-MTK: proxy id:1, proxyName: RIL_CMD_PROXY_3
12-17 08:59:49.350092 12091 12103 D RILC-MTK: QUERY_NETWORK_SELECTION_MODE pRI=0xb41d8240 p=0xb61f9148 execute on RIL_CMD_PROXY_3 using channel 1
12-17 08:59:49.354790 12091 12103 D RILC-MTK: proxyLoop free pRI=0xb41d8240 p=0xb61f9148
12-17 08:59:49.354819 12091 12103 D RILC-MTK: proxyLoop free pRequest=0xb41d4510
12-17 08:59:49.354842 12091 12103 I RILC-MTK: RIL_CMD_PROXY_3 sleep
……
12-17 08:59:51.689278 12091 12103 I RILC-MTK: RIL_CMD_PROXY_3 sleep

可是，08:59:56時間點modem上報已駐網，通知Framework去同步狀態，RILJ有下request到rild，：
12-17 08:59:56.055780 12091 12117 D AT : AT< +CREG: 1,"255F","0000FD9F",0,0,0
12-17 08:59:56.055808 12091 12117 D AT : RIL_URC_READER Enter processLine:+CREG: 1,"255F","0000FD9F",0,0,0
12-17 08:59:56.056728 1533 1796 V RILJ : [UNSL]< UNSOL_RESPONSE_VOICE_NETWORK_STATE_CHANGED {1, 255f, fd9f, 0, 0} [SUB0]
12-17 08:59:56.058354 1533 1533 D GsmSST : [GsmSST0] pollState RadioState is RADIO_ON, currentNetworkMode= 9
12-17 08:59:56.063300 1533 1533 D RILJ : [5491]> VOICE_REGISTRATION_STATE [SUB0] -->該請求在rild中沒有看到有創建

懷疑rild的request派發線程一直被佔用致使沒法處理後續新到的請求。
可是代碼中有userloaded的判斷，關鍵log沒法看到，請使用eng版本幫忙復現提供log進一步分析確認。
2、LTE網絡掉網分析

1.從log中看09:37:15:419 這個時間點就loss了，可是並無給AP側上報掉網，這個中間modem作了什麼動做呢
302470, 0, 54292552, 09:37:15:419 2017/04/26, MOD_EMM, MOD_EVAL, EVAL_EMM_SAP, MSG_ID_EVAL_EMM_PLMN_LOSS_IND
SYS (PCORE) 1481057 55073116 09:38:04:666 NIL [AT_R p25, s15]+CREG: 3,4,"FFFF","0FFFFFFF",0,0,0
[A] 由於手機必須先進行搜索，若是找不到合適的CELL 纔會報掉網到AP

[Q]那中間modem從新找網一直沒找到嗎，從37:15到38:04，這個過程是否正常要怎麼確認呢？按我理解手機不是應該會再去搜索其餘小區嗎，包括23G的
[A] 是的，從log看來手機有不斷進行234G的搜索，嘗試好久都搜不到纔會上報MM_IDLE_LIMITED_SERVICE    ，上報CREG: 0,"給AP，這時候纔會顯示掉網
Type    Index    Time    Local Time    Module    Message    Comment    Time Different
PS (PCORE)    302465    54292552    09:37:15:419    EMM_PLMNSEL - EMM_EVALIF    MSG_ID_EMM_PLMNSEL_EVALIF_PLMN_LOSS_IND        
PS (PCORE)    302470    54292552    09:37:15:419    EMM - EVAL    MSG_ID_EVAL_EMM_PLMN_LOSS_IND        
PS (PCORE)    302481    54292554    09:37:15:419    EVAL - NWSEL    MSG_ID_NWSEL_EVAL_PLMN_LOSS_IND        
PS (PCORE)    303647    54292738    09:37:15:419    NWSEL - MM    MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ        
PS (PCORE)    303649    54292738    09:37:15:419    MM - RATCM    MSG_ID_MM_RATCM_PLMN_SEARCH_REQ        
PS (PCORE)    303680    54292749    09:37:15:419    CSE_TDD - SLCE_TDD    MSG_ID_TDD_CSE_SLCE_FREQ_SCAN_REQ        
PS (PCORE)    303863    54292904    09:37:15:419    SLCE_TDD - RSVAU    MSG_ID_TDD_CPHY_FREQUENCY_SCAN_REQ        
PS (PCORE)    303865    54292905    09:37:15:419    RSVAU - SLCE_TDD    MSG_ID_TDD_CPHY_FREQUENCY_SCAN_CNF        
PS (PCORE)    303973    54295566    09:37:15:630    CSE_TDD - CSCE_TDD    MSG_ID_TDD_CSCE_CSE_CELL_SELECTION_CNF        
PS (PCORE)    303976    54295567    09:37:15:630    CSCE_TDD - RATCM    MSG_ID_RATCM_CSCE_PLMN_SEARCH_CNF        
PS (PCORE)    303999    54295570    09:37:15:630    RATCM - MM    MSG_ID_MM_RATCM_PLMN_SEARCH_CNF        
PS (PCORE)    304000    54295570    09:37:15:630    MM - NWSEL    MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF        
PS (PCORE)    304012    54295573    09:37:15:630    NWSEL - MM    MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ        
PS (PCORE)    304120    54295726    09:37:15:630    RATCM - RRM_TDD    MSG_ID_RATCM_GAS_PLMN_SEARCH_REQ        
PS (PCORE)    304302    54305128    09:37:16:321    RRM_TDD - RATCM    MSG_ID_RATCM_GAS_PLMN_SEARCH_CNF        
PS (PCORE)    304354    54305136    09:37:16:321    MM - NWSEL    MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF        
PS (PCORE)    304366    54305139    09:37:16:321    NWSEL - MM    MSG_ID_NWSEL_MM_DEACTIVATE_REQ        
PS (PCORE)    322024    54343879    09:37:18:647    EMM - EVAL    MSG_ID_EVAL_EMM_PLMN_SEARCH_CNF        
PS (PCORE)    331737    54363627    09:37:19:900    MM - RATCM    MSG_ID_MM_RATCM_PLMN_SEARCH_REQ        
PS (PCORE)    331738    54363627    09:37:19:900    RATCM - CSCE_TDD    MSG_ID_RATCM_CSCE_PLMN_SEARCH_REQ        
PS (PCORE)    331980    54366508    09:37:20:249    CSCE_TDD - RATCM    MSG_ID_RATCM_CSCE_PLMN_SEARCH_CNF        
PS (PCORE)    371531    54613068    09:37:36:029    CSCE_TDD - RATCM    MSG_ID_RATCM_CSCE_PLMN_SEARCH_CNF        
PS (PCORE)    374021    54885109    09:37:53:283    RRM_TDD - RATCM    MSG_ID_RATCM_GAS_PLMN_SEARCH_CNF        
PS (PCORE)    374082    54885120    09:37:53:283    RATCM - MM    MSG_ID_MM_RATCM_PLMN_SEARCH_CNF        
PS (PCORE)    374136    54885127    09:37:53:283    RATCM - RRM_TDD    MSG_ID_RATCM_GAS_PLMN_SEARCH_REQ        
PS (PCORE)    374873    54901161    09:37:54:464    MM - RAC    MSG_ID_GMMREG_DETACH_IND        
PS (PCORE)    374880    54901162    09:37:54:464    MM    MM new State: MM_IDLE_LIMITED_SERVICE        
SYS (PCORE)    375270    54901204    09:37:54:464    NIL    [AT_U p19, s8]+CREG: 0,"255F","0000FD8D",0,0,0        
SYS (PCORE)    375280    54901207    09:37:54:464    NIL    [AT_U p19, s8]+CGREG: 4,"255F","0000FD8D",0,"00",0,0


2.另外這個q_rxlevmin和UE S 準則這些在log裏怎麼看呢？對應協議是哪份，能否告知下
【A】 Srxlev[-41] = RSRP[-481] - (q_rxlevmin[-440] + q_rxlevmin_offset[0]) - pcomp[0]，這是根據36304的S 準則計算出來的

[Q]網絡下發的這個q_rxlevmin在log中怎麼看呢，還有手機使用s準則計算的過程
【A】能夠從SIB1 裏面看出 q-RxLevMin: -110dBm (-55)，S準則的使用就是如 Srxlev[-41] = RSRP[-481] - (q_rxlevmin[-440] + q_rxlevmin_offset[0]) - pcomp[0]，SRXLEV 必須大於0纔會顯示能夠駐留該CELL

3、GSM網絡下的掉網問題

1. 先是在服務小區，從-83dBm降到-106.5dBm
Type    Index    Time    Local Time    Module    Message    Comment    Time Different
PS    1706982    19082596    19:25:07:880    MPAL_2 - RRM_2    MSG_ID_MPAL_RR_SERV_IDLE_MEAS_IND        
PS    1729172    19097470    19:26:22:260    MPAL_2 - RRM_2    MSG_ID_MPAL_RR_SERV_IDLE_MEAS_IND        
2. 換到其餘小區，信號一樣很弱，最終掉網
Type    Index    Time    Local Time    Module    Message    Comment    Time Different
PS    1732209    19099353    19:26:31:605    RRM_2    [RMC] C1_reselection on arfcn = 51        
PS    1734579    19100672    19:26:38:265    MPAL_2 - RRM_2    MSG_ID_MPAL_RR_SERV_IDLE_MEAS_IND        
PS    1736335    19101708    19:26:43:435    MM_2 - NWSEL_2    MSG_ID_NWSEL_MM_PLMN_LOSS_IND        
3. 搜索40410，沒有搜到
Type    Index    Time    Local Time    Module    Message    Comment    Time Different
PS    1741062    19105708    19:27:03:405    NWSEL_2 - MM_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ    40410    
PS    1741619    19105850    19:27:04:150    MM_2 - NWSEL_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF        
PS    1741623    19105850    19:27:04:150    NWSEL_2 - MM_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ    40410    
PS    1747960    19109407    19:27:21:750    MM_2 - NWSEL_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF        
4. 找到40505網絡，要麼隨機接入失敗，要麼出現N200問題
Type    Index    Time    Local Time    Module    Message    Comment    Time Different
PS    1747990    19109407    19:27:21:750    NWSEL_2 - MM_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ    40505    
PS    1748860    19109707    19:27:23:435    MM_2 - NWSEL_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF        
OTA    1748903    19109707    19:27:23:435    MM_2    [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)        
OTA    1749207    19109708    19:27:23:435    RRM_2    [MS->NW] RR__CHANNEL_REQUEST        
OTA    1749748    19109716    19:27:23:435    RRM_2    [MS->NW] RR__CHANNEL_REQUEST        
OTA    1749982    19109924    19:27:24:435    RRM_2    [MS->NW] RR__CHANNEL_REQUEST        
OTA    1750234    19110144    19:27:25:435    RRM_2    [MS->NW] RR__CHANNEL_REQUEST        
OTA    1750579    19110347    19:27:26:635    RRM_2    [MS->NW] RR__CHANNEL_REQUEST        
OTA    1872436    19126325    19:28:46:525    MM_2    [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)        
OTA    1872738    19126327    19:28:46:525    RRM_2    [MS->NW] RR__CHANNEL_REQUEST        
OTA    1873274    19126334    19:28:46:525    RRM_2    [MS->NW] RR__CHANNEL_REQUEST        
OTA    1873304    19126353    19:28:46:525    RRM_2    [NW->MS] RR__IMMEDIATE_ASSIGNMENT        
PS    1873498    19126679    19:28:48:125    LISR2HISR_CTIRQ1 - RRM_2    MSG_ID_LAPDM_RR_REL_IND    

MM層的分析：

SIM2本來是camp在HPLMN的2G網絡上，可是在19:26:43時間，發生PLMN loss，SIM2從HPLMN上掉網。
以後手機有觸發找網流程，但從log來看，並無掃到HPLMN網絡，而惟一的available PLMN是40505，但手機要嘗試進行LAU過程時，connection均建不起來，致使LAU abnormal，且後續一樣發生PLMN loss現象。

Type    Index    Time    Local Time    Module    Message    Comment    Time Different
PS    44424    18742181    18:56:45:810    MM_2 - RAC_2    MSG_ID_GMMREG_ATTACH_CNF    40410 GSM    
PS    1656214    19070682    19:24:08:270    EMM - EVAL    MSG_ID_EVAL_EMM_ATTACH_CNF    405872    
PS    1660072    19072675    19:24:18:275    MM_2 - RAC_2    MSG_ID_GMMREG_ATTACH_CNF    40410 GSM    
PS    1732881    19099692    19:26:33:350    MM_2 - RAC_2    MSG_ID_GMMREG_ATTACH_CNF    40410 GSM    
PS    1736152    19101613    19:26:42:925    RATCM_2 - MM_2    MSG_ID_MM_RATCM_IDLE_OUT_OF_SERVICE_IND         
PS    1736332    19101708    19:26:43:435    RATCM_2 - MM_2    MSG_ID_MM_RATCM_PLMN_LOSS_IND    PLMN loss    
PS    1736335    19101708    19:26:43:435    MM_2 - NWSEL_2    MSG_ID_NWSEL_MM_PLMN_LOSS_IND         
PS    1736339    19101708    19:26:43:435    NWSEL_2    NWSEL_RECOVERY_TIMER_ID Timer starts, period = 20 seconds         
PS    1736342    19101708    19:26:43:435    MM_2 - RAC_2    MSG_ID_GMMREG_DETACH_IND         
PS    1741055    19105708    19:27:03:405    NWSEL_2    NWSEL_RECOVERY_TIMER_ID Timer expires when current is action NWSEL_COMM_NO_ACTION         
PS    1741058    19105708    19:27:03:405    NWSEL_2    [NWSEL] PLMN_SEARCH_LIST_TYPE NWSEL_LIST_AUTO_POWER_ON_RECOVERY         
PS    1741059    19105708    19:27:03:405    NWSEL_2    idx 0, 40410f, NWSEL_GSM, NWSEL_NOT_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, KAL_TRUE, KAL_FALSE         
PS    1741061    19105708    19:27:03:405    NWSEL_2    [NWSEL] PLMN_SEARCH_INDEX 0, RAT_GSM         
PS    1741062    19105708    19:27:03:405    NWSEL_2 - MM_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ         
PS    1741619    19105850    19:27:04:150    MM_2 - NWSEL_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF    PLMN not found    
PS    1741622    19105850    19:27:04:150    NWSEL_2    [NWSEL][Fast Roaming Search]: fullband search request PLMN_SEARCH_INDEX 0, RAT_GSM         
PS    1741623    19105850    19:27:04:150    NWSEL_2 - MM_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ         
PS    1747960    19109407    19:27:21:750    MM_2 - NWSEL_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF    PLMN not found    
PS    1747987    19109407    19:27:21:750    NWSEL_2    idx 2, 40505f, NWSEL_GSM, NWSEL_NOT_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, KAL_FALSE, KAL_FALSE         
PS    1747989    19109407    19:27:21:750    NWSEL_2    [NWSEL] PLMN_SEARCH_INDEX 2, RAT_GSM         
PS    1747990    19109407    19:27:21:750    NWSEL_2 - MM_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ         
PS    1748860    19109707    19:27:23:435    MM_2 - NWSEL_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF         
PS    1748896    19109707    19:27:23:435    MM_2 - RAC_2    MSG_ID_GMMREG_CELL_INFO_UPDATE_IND    40505 GSM    
OTA    1748903    19109707    19:27:23:435    MM_2    [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)         
PS    1748904    19109707    19:27:23:435    MM_2 - RATCM_2    MSG_ID_MM_RATCM_CONN_EST_REQ         
PS    1752116    19111061    19:27:30:035    RATCM_2 - MM_2    MSG_ID_MM_RATCM_CONN_EST_CNF         
PS    1752119    19111061    19:27:30:035    MM_2    RR reject with cause RAND_ACC_FAILURE         
OTA    1758644    19111861    19:27:34:115    MM_2    [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)         
PS    1758645    19111861    19:27:34:115    MM_2 - RATCM_2    MSG_ID_MM_RATCM_CONN_EST_REQ         
PS    1761602    19113246    19:27:41:130    RATCM_2 - MM_2    MSG_ID_MM_RATCM_CONN_EST_CNF         
PS    1761605    19113246    19:27:41:130    MM_2    RR reject with cause RAND_ACC_FAILURE         
PS    1761614    19113246    19:27:41:130    MM_2 - RAC_2    MSG_ID_GMMREG_ATTACH_CNF         
PS    1803912    19116246    19:27:56:010    MM_2    MM_T3211_TIMER_ID Timer expires in state MM_IDLE_ATTEMPTING_TO_UPDATE         
OTA    1803914    19116246    19:27:56:010    MM_2    [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)         
PS    1803915    19116246    19:27:56:010    MM_2 - RATCM_2    MSG_ID_MM_RATCM_CONN_EST_REQ         
PS    1807654    19117587    19:28:02:820    RATCM_2 - MM_2    MSG_ID_MM_RATCM_CONN_EST_CNF         
PS    1807657    19117587    19:28:02:820    MM_2    RR reject with cause RAND_ACC_FAILURE         
OTA    1827989    19118387    19:28:06:725    MM_2    [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)         
PS    1827990    19118387    19:28:06:725    MM_2 - RATCM_2    MSG_ID_MM_RATCM_CONN_EST_REQ         
PS    1828002    19118387    19:28:06:725    RATCM_2 - MM_2    MSG_ID_MM_RATCM_CONN_EST_CNF         
PS    1828007    19118387    19:28:06:725    MM_2    RR reject with cause RR_NO_SERVICE         
PS    1829845    19118511    19:28:07:365    RATCM_2 - MM_2    MSG_ID_MM_RATCM_IDLE_OUT_OF_SERVICE_IND         
PS    1829874    19118516    19:28:07:365    RATCM_2 - MM_2    MSG_ID_MM_RATCM_PLMN_LOSS_IND         
PS    1829881    19118516    19:28:07:365    NWSEL_2    [NWSEL] PLMN_SEARCH_INDEX 3, RAT_GSM         
PS    1829882    19118516    19:28:07:365    NWSEL_2 - MM_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ    ANY PLMN search    
PS    1837245    19118896    19:28:09:285    MM_2 - NWSEL_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF         
PS    1837248    19118896    19:28:09:285    NWSEL_2    NWSEL_RECOVERY_TIMER_ID Timer starts, period = 20 seconds         
PS    1866033    19122896    19:28:29:390    NWSEL_2    NWSEL_RECOVERY_TIMER_ID Timer expires when current is action NWSEL_COMM_NO_ACTION         
PS    1866037    19122896    19:28:29:390    NWSEL_2    idx 1, 40410f, NWSEL_GSM, NWSEL_NOT_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, KAL_FALSE, KAL_FALSE         
PS    1866038    19122896    19:28:29:390    NWSEL_2    [NWSEL] PLMN_SEARCH_INDEX 1, RAT_GSM         
PS    1866039    19122896    19:28:29:390    NWSEL_2 - MM_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ         
PS    1866258    19122915    19:28:29:390    MM_2 - NWSEL_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF    PLMN not found    
PS    1866261    19122915    19:28:29:390    NWSEL_2    [NWSEL][Fast Roaming Search]: fullband search request PLMN_SEARCH_INDEX 1, RAT_GSM         
PS    1866262    19122915    19:28:29:390    NWSEL_2 - MM_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ         
PS    1871586    19126142    19:28:45:590    MM_2 - NWSEL_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF    PLMN not found    
PS    1871610    19126142    19:28:45:590    NWSEL_2    idx 2, 40505f, NWSEL_GSM, NWSEL_NOT_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, KAL_FALSE, KAL_FALSE         
PS    1871612    19126142    19:28:45:590    NWSEL_2    [NWSEL] PLMN_SEARCH_INDEX 2, RAT_GSM         
PS    1871613    19126142    19:28:45:590    NWSEL_2 - MM_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ         
PS    1872392    19126325    19:28:46:525    MM_2 - NWSEL_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF         
PS    1872429    19126325    19:28:46:525    MM_2 - RAC_2    MSG_ID_GMMREG_CELL_INFO_UPDATE_IND    40505 GSM    
OTA    1872436    19126325    19:28:46:525    MM_2    [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)         
PS    1872437    19126325    19:28:46:525    MM_2 - RATCM_2    MSG_ID_MM_RATCM_CONN_EST_REQ         
PS    1885407    19129687    19:29:03:345    MM_2    MM_T3211_TIMER_ID Timer expires in state MM_IDLE_ATTEMPTING_TO_UPDATE         
OTA    1885409    19129687    19:29:03:345    MM_2    [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)         
PS    1894000    19131829    19:29:14:050    MM_2    MM_T3213_TIMER_ID Timer expires in state MM_IDLE_ATTEMPTING_TO_UPDATE         
OTA    1894002    19131829    19:29:14:050    MM_2    [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)         
PS    1902019    19133765    19:29:23:720    MM_2 - RAC_2    MSG_ID_GMMREG_CELL_INFO_UPDATE_IND         
OTA    1902024    19133765    19:29:23:720    MM_2    [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)         
PS    1908981    19135317    19:29:31:485    MM_2 - RAC_2    MSG_ID_GMMREG_CELL_INFO_UPDATE_IND         
OTA    1908986    19135317    19:29:31:485    MM_2    [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)         
OTA    1910026    19135524    19:29:32:485    MM_2    [NW->MS] MM__LOCATION_UPDATING_REJECT         
PS    1910030    19135524    19:29:32:485    MM_2    Location Update is rejected with cause ROAMING_AREA_NOT_ALLOWED         
PS    1910795    19135670    19:29:33:085    NWSEL_2    [NWSEL] PLMN_SEARCH_INDEX 3, RAT_GSM         
PS    1910796    19135670    19:29:33:085    NWSEL_2 - MM_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ         
PS    1917408    19136268    19:29:36:210    MM_2 - NWSEL_2    MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF

3、變換選網模式以及RAU_REJECT致使的掉網

log能夠看到有兩次掉網， 其中在13:47:33的掉網是因爲設置網絡模式爲3G only，按照設計是會主動detach以後從新搜網註冊，因此有短暫的掉網是正常的。

另外在13:46:07掉網是因爲收到了RAU reject，以後又從新進行PS attach，這裏會請其餘模塊同事確認一下上報掉網是否正常，謝謝！

OTA    3133396    45380    13:46:07:415    MM    [MS->NW] GMM__ROUTING_AREA_UPDATE_REQUEST        
OTA    3138520    48248    13:46:21:815    MM    [NW->MS] GMM__ROUTING_AREA_UPDATE_REJECT        
PS    3138522    48248    13:46:21:815    MM    RAU rejected with cause MS_ID_NOT_DERIVED_BY_NW        
PS    3138523    48248    13:46:21:815    MM - RAC    MSG_ID_GMMREG_NW_REJECT_IND        
SYS    3140329    48333    13:46:22:215    NIL    [AT_U p23, s14]+CREG: 0,"FFFF","0FFFFFFF",0,0,0        

SYS    3132614    45103    13:46:06:015    NIL    [AT_I p21, s11]AT+ERAT=6,0
        
SYS    3252152    62636    13:47:33:820    NIL    [AT_I p21, s11]AT+ERAT=1,0
        
PS    3252237    62636    13:47:33:820    RAC - MM    MSG_ID_GMMREG_SET_RAT_MODE_REQ        
OTA    3252250    62636    13:47:33:820    MM    [MS->NW] GMM__DETACH_REQUEST        
OTA    3255962    63128    13:47:36:220    MM    [NW->MS] GMM__DETACH_ACCEPT        
SYS    3256332    63128    13:47:36:220    NIL    [AT_U p18, s8]+CREG: 0,"FFFF","0FFFFFFF",0,0,0        
OTA    3263579    63565    13:47:38:430    MM    [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)        
OTA    3268210    64442    13:47:42:830    MM    [NW->MS] MM__LOCATION_UPDATING_ACCEPT

4、MTK平臺終端作TAU被#15拒後關掉EUTRAN能力

出現沒法註冊4G是因爲在設置rat mode時detach\ attach 過程出現被網絡以NO_SUITABLE_CELL_IN_TA的cause拒絕，這樣MTK設計是會將EUTRAN disable掉，而對比機因爲沒有看到有設置RAT mode，因此沒有出現此現象，貴司能夠選擇不把4G disable，方法以下：
將SBP_ DISABLE_EUTRAN_AFTER_NO_SUITABLE關掉。

1.請將 nvram_data_items.c中此SBP_DISABLE_EUTRAN_AFTER_NO_SUITABLE_作以下修改：
//#if defined(__DISABLE_EUTRAN_AFTER_NO_SUITABLE__)
0x40 |
//#endif
修改成如下：
#if defined(__DISABLE_EUTRAN_AFTER_NO_SUITABLE__)
0x40 |
#endif

2. 在nvram_editor_data_item.h
將NVRAM_EF_SBP_MODEM_CONFIG_LID_VERNO 升級加1，也就是說，
若是原來是：
#define NVRAM_EF_SBP_MODEM_CONFIG_LID_VERNO "000"
將其修改成：
#define NVRAM_EF_SBP_MODEM_CONFIG_LID_VERNO "001"
若是原來是：
#define NVRAM_EF_SBP_MODEM_CONFIG_LID_VERNO "001"
將其修改成：
#define NVRAM_EF_SBP_MODEM_CONFIG_LID_VERNO "002"
請build以後按照FAQ14656 double check option已經打開，而後進行測試。

也能夠參考FAQ17855
Eutran Disable due to ATTACH REJECT with Cause #15 (No Suitable cells in Tracking Area)

SYS    3549103    3078590    15:16:22:475    NIL    [AT_I p21, s11]AT+ERAT=3,0
        
SYS    3583971    3079150    15:16:25:230    NIL    [AT_I p21, s11]AT+ERAT=3,0
        
SYS    3667238    3080512    15:16:32:030    NIL    [AT_I p21, s11]AT+ERAT=6,0
        
OTA    3667448    3080512    15:16:32:030    EMM_NASMSG    [MS->NW] EMM_Detach_Request(Detach type="MO_EPS_DETACH", switch-off="KAL_FALSE")        
OTA    3669080    3080535    15:16:32:030    EMM_NASMSG    [NW->MS] EMM_Detach_Accept        
OTA    3687684    3080753    15:16:33:230    ERRC_SYS    [NW->MS] SystemInformationBlockType1 (EARFCN[6200], PCI[153])        
OTA    3690392    3080782    15:16:33:430    EMM_NASMSG    [MS->NW] EMM_Attach_Request(EPS attach type="EMM_ATTACH_TYPE_COMBINED_ATTACH")        
OTA    3691581    3080797    15:16:33:430    EMM_NASMSG    [NW->MS] EMM_Attach_Reject(EMM cause="EMM_CAUSE_NO_SUITABLE_CELL_IN_TA")

在HPLMN上被reject，默認會被禁12小時：

Type    Index    Time    Local Time    Module    Message    Comment    Time Different
OTA    3687684    3080753    15:16:33:230    ERRC_SYS    [NW->MS] SystemInformationBlockType1 (EARFCN[6200], PCI[153])        
OTA    3690392    3080782    15:16:33:430    EMM_NASMSG    [MS->NW] EMM_Attach_Request(EPS attach type="EMM_ATTACH_TYPE_COMBINED_ATTACH")        
OTA    3691581    3080797    15:16:33:430    EMM_NASMSG    [NW->MS] EMM_Attach_Reject(EMM cause="EMM_CAUSE_NO_SUITABLE_CELL_IN_TA")        
PS    4839519    3185653    15:25:17:720    NWSEL    [NWSEL] NWSEL 62130f is HPLMN        

custom_nwsel_config.c
/*************************************************************************
* EUTRAN disable timer for reject cause #15 in HPLMN
*
* For 23G only SIM, UE will be reject with cause #13, #15 in 4G NW.
* To opitimize power consumption, disable EUTRAN in HPLMN if reject cause #13, #15 is received in 4G PLMN.
*************************************************************************/
/* This value is 12 hrs */
const kal_uint32 NWSEL_EUTRAN_DISABLE_FOR_REJ_IN_HPLMN_TIMER_VALUE = KAL_TICKS_1_MIN * 60 * 12;

5、TAU跟新EFloci致使的stk上報問題

若是EF_LOCI更新就會致使這條stk上報，那應該每次位置更新都會上報吧
-->
並非說只要有EF_LOCI更新就會上報這條STK DISPLAY TEXT（歡迎提示語）
根據以往的處理，注網狀態會下發給SIM卡，EF_LOCI文件會更新等會引發卡是否要上報DISPLAY TEXT（歡迎提示語）
可是具體卡是根據什麼內容，決定要上報DISPLAY TEXT（歡迎提示語），是由運營商實做卡時決定的。


此次從上下文來看，是MM那邊要求更新的EF_LOCI.
1388932, 0, 57413594, 10:26:09:187 2017/03/20, MOD_MM_2, , TRACE_STATE, MM new State: MM_LOCATION_UPDATING_INITIATED
1388935, 0, 57413595, 10:26:09:187 2017/03/20, MOD_MM_2, MOD_SIM_2, PS_SIM_SAP, MSG_ID_SAT_MM_CONNECTION_INFO_IND
1389558, 0, 57417920, 10:26:09:387 2017/03/20, MOD_MM_2, MOD_SIM_2, PS_SIM_SAP, MSG_ID_SIM_AUTHENTICATE_REQ
1390079, 0, 57424788, 10:26:09:793 2017/03/20, MOD_SIM_2, MOD_MM_2, PS_SIM_SAP, MSG_ID_SIM_AUTHENTICATE_CNF
1390082, 0, 57424789, 10:26:09:793 2017/03/20, MOD_MM_2, MOD_SIM_2, PS_SIM_SAP, MSG_ID_SIM_WRITE_REQ
1390235, 0, 57425469, 10:26:09:993 2017/03/20, MOD_SIM_2, , TRACE_INFO, SELECT:FILE_U_KEYS_IDX => 90 00
1390489, 0, 57427269, 10:26:09:993 2017/03/20, MOD_SIM_2, , TRACE_INFO, SELECT:FILE_U_KC_IDX => 90 00
1391609, 0, 57432338, 10:26:10:393 2017/03/20, MOD_SIM_2, , TRACE_INFO, SELECT:FILE_U_LOCI_IDX => 90 00
1391743, 0, 57433733, 10:26:10:393 2017/03/20, MOD_SIM_2, , TRACE_INFO, UPDATE BINARY offset: 0 length: 11 => 91 32
觸發上報 DISPLAY TEXT（歡迎提示語）和前一份log同樣，都是更新EF_LOCI，具體log以下。
可是這份log中還更新了幾回EF_LOCI,其餘case沒有觸發DISPLAY TEXT
就如咱們電話溝通的，並不必定只要有更新EF_LOCI就會上報，卡具體是根據什麼條件決定是否要上報DISPLAY TEXT（歡迎提示語），由卡來決定。


119870, 0, 187102227, 14:13:17:839 2017/05/08, MOD_EVAL, MOD_SIM, PS_SIM_SAP, MSG_ID_SIM_AUTHENTICATE_REQ
120228, 0, 187109052, 14:13:18:260 2017/05/08, MOD_SIM, MOD_EVAL, PS_SIM_SAP, MSG_ID_SIM_AUTHENTICATE_CNF
121099, 0, 187111370, 14:13:18:461 2017/05/08, MOD_MM, MOD_SIM, PS_SIM_SAP, MSG_ID_SIM_WRITE_REQ
121184, 0, 187111380, 14:13:18:461 2017/05/08, MOD_SIM, , TRACE_GROUP_3, SIM_SELECT : length: 10
121185, 0, 187111380, 14:13:18:461 2017/05/08, MOD_SIM, , TRACE_GROUP_3, APDU_tx 0: 00 A4 08 04 04 7F FF 6F 7E 00 F2 F2 F2 F2 F2 F2
122909, 0, 187112030, 14:13:18:461 2017/05/08, MOD_SIM, , TRACE_INFO, SELECT:FILE_U_LOCI_IDX => 90 00
122911, 0, 187112030, 14:13:18:461 2017/05/08, MOD_SIM, , TRACE_GROUP_3, SIM_UPDATE_BINARY : length: 16
122912, 0, 187112030, 14:13:18:461 2017/05/08, MOD_SIM, , TRACE_GROUP_3, APDU_tx 0: 00 D6 00 00 0B 23 C1 F9 06 64 F0 10 A5 31 00 00
125699, 0, 187113443, 14:13:18:461 2017/05/08, MOD_SIM, , TRACE_INFO, UPDATE BINARY offset: 0 length: 11 => 91 32
125701, 0, 187113443, 14:13:18:461 2017/05/08, MOD_SIM, MOD_MM, PS_SIM_SAP, MSG_ID_SIM_WRITE_CNF
125704, 0, 187113444, 14:13:18:461 2017/05/08, MOD_SIM, , TRACE_GROUP_3, SIM_FETCH : length: 5
125705, 0, 187113444, 14:13:18:461 2017/05/08, MOD_SIM, , TRACE_GROUP_3, APDU_tx 0: 80 12 00 00 32 F2 F2 F2 F2 00 00 0A 32 91 00 00
126203, 0, 187114258, 14:13:18:662 2017/05/08, MOD_SIM, , TRACE_GROUP_3, APDU_rx length: 50
126204, 0, 187114258, 14:13:18:662 2017/05/08, MOD_SIM, , TRACE_GROUP_3, APDU_rx 0: D0 30 81 03 01 21 01 82 02 81 02 0D 25 08 5C 0A
126205, 0, 187114258, 14:13:18:662 2017/05/08, MOD_SIM, , TRACE_GROUP_3, APDU_rx 1: 65 6C 76 84 75 28 62 37 FF 0C 6B 22 8F CE 60 A8
126206, 0, 187114258, 14:13:18:662 2017/05/08, MOD_SIM, , TRACE_GROUP_3, APDU_rx 2: 4F 7F 75 28 4E 2D 56 FD 80 54 90 1A 4E 1A 52 A1
126207, 0, 187114258, 14:13:18:662 2017/05/08, MOD_SIM, , TRACE_GROUP_3, APDU_rx 3: FF 01 F2 F2 F2 F2 00 00 00 00 00 00 00 00 00 00
126209, 0, 187114258, 14:13:18:662 2017/05/08, MOD_SIM, , TRACE_INFO, FETCH 50 bytes => 90 00
126210, 0, 187114258, 14:13:18:662 2017/05/08, MOD_NIL, MOD_SIM, PS_SIM_SAP, MSG_ID_SAT_PROACTIVE_CMD_IND
126211, 0, 187114258, 14:13:18:662 2017/05/08, MOD_SIM, MOD_L4C, PS_SIM_SAP, MSG_ID_SAT_DSPL_TEXT_IND
6、撥打緊急電話致使掉網的問題

根據MTK design，若是2G沒法打通緊急號碼，會detach後搜索3G ANY PLMN並嘗試重撥
Type    Index    Time    Local Time    Module    Message    Comment    Time Different
PS    237255    3966062    17:11:25:510    CC - MM    MSG_ID_MMCC_START_CALL_REQ        
PS    237256    3966062    17:11:25:510    CC - MM    MSG_ID_MMCC_EST_REQ        
PS    237257    3966062    17:11:25:510    MM    ACCESS not allowed in current cell,[Cell class]400,[MS class]200        
PS    237258    3966062    17:11:25:510    MM    CM service is rejected because of access class not allowed        
PS    237259    3966062    17:11:25:510    MM - CC    MSG_ID_MMCC_EST_REJ        //2G沒法撥通
OTA    237628    3966064    17:11:25:510    MM    [MS->NW] GMM__DETACH_REQUEST        //detach
OTA    241522    3966297    17:11:26:710    MM    [NW->MS] GMM__DETACH_ACCEPT        //detach完成
PS    246674    3966317    17:11:26:710    NWSEL - MM    MSG_ID_NWSEL_MM_PLMN_SEARCH_REQ        //搜3G，ANY PLMN
PS    248857    3966410    17:11:27:310    MM - NWSEL    MSG_ID_NWSEL_MM_PLMN_SEARCH_CNF        //成功
OTA    249082    3966410    17:11:27:310    MM    [MS->NW] MM__CM_SERVICE_REQUEST        
OTA    250976    3966457    17:11:27:510    ADR    [MS->NW] RRC__RRC_CONNECTION_REQUEST        
OTA    251419    3966512    17:11:27:710    ADR    [MS->NW] RRC__RRC_CONNECTION_SETUP_COMPLETE        
OTA    252165    3966586    17:11:28:110    MM    [NW->MS] MM__CM_SERVICE_ACCEPT        
OTA    252174    3966586    17:11:28:110    CC    [MS->NW] CC__EMERGENCY_SETUP        //3G上撥打

AP側UI對應代碼邏輯：

目前與statusbar sim卡圖標顯示相關的文件有：
/frameworks/base/packages/SystemUI/src/com/android/systemui/statusbar/policy/NetworkControllerImpl.java
/frameworks/base/packages/SystemUI/src/com/android/systemui/statusbar/policy/MobileSignalController.java
/frameworks/base/packages/SystemUI/src/com/android/systemui/statusbar/SignalClusterView.java

對於信號強度圖標的顯示默認的邏輯爲：
MobileSignalController.java中以下函數在底層上報信號強度有變化時會被回調
8 public void onSignalStrengthsChanged(SignalStrength signalStrength) {
649 if (DEBUG) {
650 Log.d(mTag, "onSignalStrengthsChanged signalStrength=" + signalStrength +
651 ((signalStrength == null) ? "" : (" level=" + signalStrength.getLevel())));
652 }
653 mSignalStrength = signalStrength;
654 updateTelephony();
655 }

以後經過MobileSignalController.java的updateTelephony來進行相應狀態圖標的獲取及對應狀態的更新，updateTelephony的以下代碼更新mCurrentState.level
if (mCurrentState.connected) {
543 if (!mSignalStrength.isGsm() && mConfig.alwaysShowCdmaRssi) {
544 mCurrentState.level = mSignalStrength.getCdmaLevel();
545 } else {
546 mCurrentState.level = mSignalStrength.getLevel();
547 }
548 /// M: Customize the signal strength level. @ {
549 mCurrentState.level = mStatusBarExt.getCustomizeSignalStrengthLevel(
550 mCurrentState.level, mSignalStrength, mServiceState);
551 /// @ }
552 }

接着MobileSignalController.java的notifyListeners會被調用，以下獲取信號強度的圖標：
/// M: Customize the signal strength icon id. @ {
264 int iconId = getCurrentIconId(); //此函數根據level值獲取要使用的圖標
265 iconId = mStatusBarExt.getCustomizeSignalStrengthIcon(
266 mSubscriptionInfo.getSubscriptionId(),
267 iconId,
268 mSignalStrength,
269 mDataNetType,
270 mServiceState);
最後經過調用SignalClusterView.java的setMobileDataIndicators徹底後續顯示步驟。

7、顯示4G+的問題

AT命令：

這個是AP查詢PS能力的：
422681, 0, 225923787, 15:35:27:230 2017/06/10, MOD_NIL, , TRACE_INFO, [AT_U p19, s8]+PSBEARER: 8192,3 //第一個參數8192（16進制的0x2000）表明 L4C_LTE_CA_SUPPORT

466117, 0, 226030575, 15:35:33:922 2017/06/10, MOD_NIL, , TRACE_INFO, [AT_U p19, s8]+PSBEARER: 4096,3 //第一個參數4096（16進制的0x1000）表明 L4C_LTE_SUPPORT

從modem log看檔網絡配置好scell後，modem會上報8192，當手機回到idle態，或者剛進入鏈接態尚未配置scell會上報4096

modem邏輯：

手機有時顯示4G有時顯示4G+是正常的，顯示4G+說明手機進入鏈接態而且配置了輔助小區scell（也就是手機正在使用CA功能）。若是手機回到idle態或網絡沒有配置scell則手機會顯示4G。

您提到的時間點15:50測試機確實沒有進入過4G+，由於網絡沒有配置scell。但沒有同一時間段的對比機log因此不清楚是否對比機在不一樣的小區，網絡配置不一樣。

對比15:35左右的狀況，測試機是比對比機進入4G+要多的。
進入4G+的相關log：
在鏈接態網絡可能會發來RRC重配置命令，裏面會配置SCELL
OTA (PCORE)    524550    226269543    15:35:49:263    ERRC_SYS    [NW->MS] SystemInformationBlockType1 (EARFCN[100], PCI[324])        
OTA (PCORE)    527259    226271373    15:35:49:471    ERRC_CONN    [NW->MS] ERRC_RRCConnectionReconfiguration(measCfg:[0],mobCtrlInfo:[0],dedInfoNASList:[0],radioresCfgDed:[1],secCfgHO:[0])        
PS (PCORE)    527316    226271377    15:35:49:471    ERRC_CHM    [CHM] SCell[1] with pci[324] & earfcn[1825] is added in SCell add/mod list        //配置了scell
PS (PCORE)    527621    226271515    15:35:49:471    ERRC_MOB    [MMC] add SCell, 1st SCell earfcn[1825] pci[324] nw_config[KAL_TRUE]        

以後手機手機收到切換命令或收到RRC釋放命令，scell會被清除，手機會顯示4G。
OTA (PCORE)    559621    226372733    15:35:55:819    ERRC_CONN    [NW->MS] ERRC_RRCConnectionReconfiguration(measCfg:[1],mobCtrlInfo:[1],dedInfoNASList:[0],radioresCfgDed:[1],secCfgHO:[1])    //切換    
PS (PCORE)    560353    226373029    15:35:55:819    ERRC_MOB    [MMC] delete SCell   

AP側邏輯：

默認版本已經在LTEA改爲了LTE網絡，正常應該是不會顯示4G+的。
具體改的代碼在以下文件的以下方法。
貴司說是有時候能夠顯示其4G+，是在哪裏進行修改了嗎？
/frameworks/base/telephony/java/android/telephony/ServiceState.java
1198 public void setProprietaryDataRadioTechnology(int rt) {
1199 if (rt > ServiceState.RIL_RADIO_TECHNOLOGY_MTK) {
1200 if (DBG) Rlog.d(LOG_TAG, "[ServiceState] setProprietaryDataRadioTechnology =" + rt);
1201 mProprietaryDataRadioTechnology = rt;
1202 //carrier aggregation
1203 if (rt == ServiceState.RIL_RADIO_TECHNOLOGY_LTEA) {
1204 rt = ServiceState.RIL_RADIO_TECHNOLOGY_LTE;
1205 } else {
1206 rt = ServiceState.RIL_RADIO_TECHNOLOGY_HSPAP;
1207 }
1208 } else {
1209 if (DBG) Rlog.d(LOG_TAG, "[ServiceState] setProprietaryDataRadioTechnology=0");
1210 mProprietaryDataRadioTechnology = 0;
1211 }
1212 setRilDataRadioTechnology(rt);
1213 }

8、attach被reject #99

另外被reject以後，按照協議是會把attempt counter置爲最大，這樣按照MTK的處理會把eutran disable掉，因此以後也沒有搜索4G網絡。

d) ATTACH REJECT, other EMM cause values than those treated in subclause 5.5.1.2.5, and cases of EMM cause
#22, if considered as abnormal cases according to subclause 5.5.1.2.5
Upon reception of the EMM cause #19 "ESM failure", if the UE is not configured for NAS signalling low
priority, the UE may set the attach attempt counter to 5. If the attach request is neither for emergency bearer
services nor for initiating a PDN connection for emergency bearer services with attach type not set to "EPS
emergency attach", upon reception of the EMM causes #95, #96, #97, #99 and #111 the UE should set the attach
attempt counter to 5.

9、實驗卡LAI相同致使未作LU

卡2註冊上了是由於SIM卡2中stored LAI 與 ARFCN[1]小區的LAI相同，不會觸發LAU過程，就已經註冊上了：
Type    Index    Time    Local Time    Module    Message    Comment    Time Different
PS    20425    22939    15:24:57:265    RATCM_2 - RRM_2    MSG_ID_RATCM_GAS_PLMN_SEARCH_REQ        
PS    20516    22942    15:24:57:265    RRM_2 - MPAL_2    MSG_ID_RR_MPAL_SEARCH_RF_REQ        
PS    26072    23083    15:24:58:065    MPAL_2 - RRM_2    MSG_ID_MPAL_RR_SEARCH_RF_CNF        
PS    26079    23083    15:24:58:065    RRM_2    [RCS] There are [1] ARFCNs to try        
PS    26080    23083    15:24:58:065    RRM_2    [RCS] Sorted power scan list: Index:0 ARFCN:1 POWER:-324        
OTA    27199    23150    15:24:58:265    RRM_2    [NW->MS] RR__SI_3 (ARFCN[1], TC[2])        
PS    32275    23432    15:24:59:665    RRM_2    [RCS] PLMN search result -> PLMN_FOUND        
PS    32276    23432    15:24:59:665    RRM_2 - RATCM_2    MSG_ID_RATCM_GAS_PLMN_SEARCH_CNF        
PS    32347    23432    15:24:59:665    RRM_2    [RRM] One equivalent PLMN: 00101f        
PS    32371    23432    15:24:59:665    MM_2    Current LAI and stored LAI are same        
SYS    32607    23433    15:24:59:865    NIL    [AT_U p23, s14]+CREG: 1,"0001","00000001",0,0,0

而卡1中Current LAI and stored LAI are different，因此觸發LAU過程，隨機接入的過程（RR__CHANNEL_REQUEST發給網絡）一直得不到網絡的迴應致使LAU過程失敗，沒法註冊：
PS    41166    23700    15:25:01:065    RATCM - RRM    MSG_ID_RATCM_GAS_PLMN_SEARCH_REQ        
PS    41615    23701    15:25:01:065    RRM - MPAL    MSG_ID_RR_MPAL_SEARCH_RF_REQ        
PS    51310    23842    15:25:01:865    MPAL - RRM    MSG_ID_MPAL_RR_SEARCH_RF_CNF        
PS    51318    23842    15:25:01:865    RRM    [RCS] Sorted power scan list: Index:0 ARFCN:1 POWER:-320        
OTA    52685    23903    15:25:02:065    RRM    [NW->MS] RR__SI_3 (ARFCN[1], TC[2])        
PS    61739    24185    15:25:03:465    RRM - RATCM    MSG_ID_RATCM_GAS_PLMN_SEARCH_CNF        
PS    61835    24186    15:25:03:465    RRM    [RRM] One equivalent PLMN: 00101f        
PS    61901    24186    15:25:03:465    MM    Cell Change Action Type: MM_LAI_CHANGE        
PS    61909    24186    15:25:03:465    MM    Current LAI and stored LAI are different        
OTA    61922    24187    15:25:03:465    MM    [MS->NW] MM__LOCATION_UPDATING_REQUEST (LU type: MM_NORMAL_LU)        
OTA    61958    24187    15:25:03:465    RRM    [MS->NW] RR__CHANNEL_REQUEST        
OTA    63566    24195    15:25:03:665    RRM    [MS->NW] RR__CHANNEL_REQUEST        

因此卡1是沒有成功隨機接入過程，沒法判斷當前網絡是不是正常的

我想請教下，這個SIM卡2中stored LAI是一開機就有嗎，比方說關機或者開關飛行模式這些是否會刪除這個LAI呢，仍是說是由於卡2以前確定註冊成功過因此裏面有了這個LAI

答：開機後UE會去search PLMN，以後網絡會給回覆，在system info 裏面會有這個LAI。不必定是註冊成功後。
LAI是存儲在store LAI list裏面。開關機跟飛模都不會清掉。只有UE在註冊過程當中收到
# 11: (PLMN not allowed);# 2: (IMSI unknown in HLR);
# 3: (Illegal MS); or # 6: (Illegal ME).# 12: (Location Area not allowed);等cause時，會把LAI清掉。

//store LAI list是存儲在手機側仍是SIM卡中EFloci文件中，另外若是開關機都不清除，那是否會出現個問題，假如剛開機
終端搜網後發現網絡的LAI和手機中存儲的LAI同樣，而後終端不會去作LU，那麼這時網絡並不知道終端在哪裏，那是否這時候
終端就收不到尋呼了呢？

答：
第一個問題：LAI是存儲在SIM卡的EFloci文件。在SIM_ready消息中能夠看到。
第二個問題：假設是開關機的狀況，終端搜網後發現網絡的LAI和手機中存儲的LAI同樣，終端不會去作LU，但這時候終端會去作IMSI attach 跟網絡之間來註冊，而後網絡會知道UE的註冊狀況。假設是插拔卡，如本題所示的狀況。由於log中沒有包含拔卡的log，不清楚拔卡後UE側的行爲是怎麼樣的。從現有log來看，插入卡2 後，卡2進行search網，發現網絡的LAI和手機中存儲的LAI同樣，沒有去作任何註冊procedure就直接註冊上網了。那假設拔卡的時候卡2沒有作detach procedure，那log中的卡2行爲就是正常的。若是卡2 作了detach行爲，那log中的卡2須要作attach才正常。所以，須要知道拔卡後卡2的行爲才能具體判斷此次插入卡2後 的駐網行爲是否正常。
所以，這題要知道root cause，須要煩請貴司從新提供一份包含拔卡，插卡，駐網成功的完整過程。

卡2 的駐網行爲以下：

Type    Index    Time    Local Time    Module    Message    Comment    Time Different
        
PS    893    22353    15:24:54:465    SIM_2 - MM_2    MSG_ID_SIM_ERROR_IND        
PS    3353    22479    15:24:55:065    GMSS_2 - NWSEL_2    MSG_ID_GMSS_NWSEL_SIM_READY_REQ        
SYS    22682    22969    15:24:57:465    NIL    [AT_R p24, s15]+CREG: 3,2,"FFFF","0FFFFFFF",0,0,0
PS    32339    23432    15:24:59:665    RATCM_2 - MM_2    MSG_ID_MM_RATCM_PLMN_SEARCH_CNF        
PS    32340    23432    15:24:59:665    RATCM_2 - MM_2    MSG_ID_MM_RATCM_SYS_INFO_IND        
PS    32371    23432    15:24:59:665    MM_2    Current LAI and stored LAI are same        
PS    32373    23432    15:24:59:665    MM_2 - RAC_2    MSG_ID_GMMREG_ATTACH_CNF        
PS    32389    23432    15:24:59:665    MM_2 - NWSEL_2    MSG_ID_NWSEL_MM_REGN_RESULT_IND        
PS    32394    23432    15:24:59:665    NWSEL_2    [NWSEL] NWSEL_MM_PROC_LU LR_ACCEPT CAUSE_NONE        
SYS    32607    23433    15:24:59:865    NIL    [AT_U p23, s14]+CREG: 1,"0001","00000001",0,0,0

10、4G下attach被拒一直顯示3G

從目前的log來看，開機後4G attach過程被reject，緣由是由於ESM FAILURE，手機收到該緣由的rejection，會先把該PLMN的4G功能disable，並起EUTRAN_DISABLE_TIMER，只有當定時器超時後纔會從新enable該PLMN的4G功能。
請問問題復現機率有多高？
是否能夠幫忙提供開機能夠正常camp聯通4G的包括開機過程的log以便能進行對比分析？
目前提供的對比機log沒有開機過程，因此沒法對比確認attach過程的參數是否有差異。
Thanks

Type    Index    Time    Local Time    Module    Message    Comment    Time Different
PS    27122    1731    08:02:27:850    SIM - GMSS    MSG_ID_SIM_GMSS_READY_IND    46001    
SYS    78679    4467    08:02:41:450    NIL    [AT_I p21, s11]AT+CGDCONT=0,"IPV4V6","3gnet",,0,0,0,0,1,0

PS    79948    4482    08:02:41:650    NWSEL    idx 0, 46001f, NWSEL_TD_FDD_LTE, NWSEL_NOT_SEARCHED, NWSEL_UMTS, NWSEL_NOT_SEARCHED, NWSEL_GSM, NWSEL_NOT_SEARCHED, NWSEL_RAT_NONE, NWSEL_SEARCHED, KAL_TRUE, KAL_FALSE         
PS    79950    4482    08:02:41:650    NWSEL    [NWSEL] PLMN_SEARCH_INDEX 0, RAT_LTE         
PS    79951    4482    08:02:41:650    NWSEL - EVAL    MSG_ID_NWSEL_EVAL_PLMN_SEARCH_REQ         
PS    85167    4544    08:02:41:850    EVAL - NWSEL    MSG_ID_NWSEL_EVAL_PLMN_SEARCH_CNF         
OTA    101906    4915    08:02:43:850    ESM    [MS->NW] ESM_MSG_PDN_CONNECTIVITY_REQUEST (PTI:1, EBI:0)         
OTA    104189    4926    08:02:43:850    EMM_NASMSG    [MS->NW] EMM_Attach_Request(EPS attach type="EMM_ATTACH_TYPE_COMBINED_ATTACH")         
OTA    110625    5001    08:02:44:250    ESM    [MS->NW] ESM_MSG_ESM_INFORMATION_RESPONSE (PTI:1, EBI:0)    APN: 3gnet    
OTA    111890    5015    08:02:44:250    EMM_NASMSG    [NW->MS] EMM_Attach_Reject(EMM cause="EMM_CAUSE_ESM_FAILURE")         
OTA    112032    5015    08:02:44:250    ESM    [NW->MS] ESM_MSG_PDN_CONNECTIVITY_REJECT (PTI:1, EBI:0, ESM cause:"ESM_CAUSE_USER_AUTH_FAILED")         
PS    112042    5015    08:02:44:250    EMM_REG    [EMM REG] Set attach attempt count to MAX         
PS    112338    5016    08:02:44:250    NWSEL    PLMN 46001f is in EUTRAN disabled list, cause: CS - NWSEL_REJ_CAUSE_CS_ABNORMAL; PS - NWSEL_REJ_CAUSE_PS_ABNORMAL         
PS    112340    5016    08:02:44:250    NWSEL    NWSEL_EUTRAN_DISABLE_TIMER_ID Timer starts, period = 720 seconds         
PS    112341    5016    08:02:44:250    NWSEL    [NWSEL] PLMN_SEARCH_INDEX 0, RAT_UMTS         
PS    1267663    149016    08:14:44:350    NWSEL    NWSEL_EUTRAN_DISABLE_TIMER_ID Timer expires when current is action NWSEL_COMM_NO_ACTION         
PS    1267667    149016    08:14:44:350    NWSEL - MM    MSG_ID_NWSEL_MM_EUTRAN_CAP_UPDATE_REQ    EUTRAN_ENABLED    
OTA    1282030    150666    08:14:52:510    EMM_NASMSG    [MS->NW] EMM_Tracking_Area_Update_Request(EPS update type="EMM_UPDATE_TYPE_COMBINED_TAU_IMSI_ATTACH", active flag="KAL_FALSE")         
OTA    1287381    150747    08:14:52:910    EMM_NASMSG    [NW->MS] EMM_Tracking_Area_Update_Accept(EPS update result="EMM_UPDATE_RESULT_COMBINED_UPDATED")         
OTA    1287564    150747    08:14:52:910    EMM_NASMSG    [MS->NW] EMM_Tracking_Area_Update_Complete

11、4G下attach被拒致使將TA加入禁止列表

此問題是網絡發來detach request,致使手機將當前的TA加入到禁止TA list,而手機當時只能搜到這一個TA的小區，因此以後一直沒法選到可用4G小區沒法正常服務。

OTA (PCORE)    317209    45018082    10:40:45:142    EMM_NASMSG    [NW->MS] EMM_Detach_Request(Detach type="MT_REATTACH_NOT_REQUIRED", EMM cause="EMM_CAUSE_NO_EPS_CTXT_ACT")        
OTA (PCORE)    317283    45018088    10:40:45:142    EMM_NASMSG    [MS->NW] EMM_Detach_Accept        
PS (PCORE)    319121    45018422    10:40:45:142    EMM_REG    [EMM REG] Complete NW detach with re-attach not required (cause 40)        
PS (PCORE)    319130    45018423    10:40:45:142    EMM_REG    [EMM REG] Add current TAI to FTAI list for roaming         //加入禁止TA
PS (PCORE)    326719    45022875    10:40:45:344    ERRC_CEL    [CEL_DI/LV] cell failed: earfcn[1825]/pci[166], fail[ERRC_CEL_TRACE_DI_JUDGE]        //選擇小區一直失敗，由於當前TA不能駐留
PS (PCORE)    329413    45024749    10:40:45:544    ERRC_CEL    [CEL_DI/LV] cell failed: earfcn[100]/pci[465], fail[ERRC_CEL_TRACE_DI_JUDGE]        
PS (PCORE)    332661    45030942    10:40:45:988    ERRC_CEL    [CEL_DI/LV] cell failed: earfcn[1825]/pci[324], fail[ERRC_CEL_TRACE_DI_JUDGE]    

12、4G小區重選

如何確認終端當時是駐留在4G仍是其餘RAT上
能夠查看PS Trace peer看當前打印的OTA日誌是4G的仍是2G的。
或者從System Trace裏面看CGREG
Type    Index    Time    Local Time    Module    Message    Comment    Time Different
SYS (PCORE)    30552    424833    09:51:58:678    NIL    [AT_R p20, s9]+CGREG: 3,1,"2805","02E1ED15",7,"00",0,0 
=> Decode:GPRS network registration status +CGREG
<n> : 3(enable network registration, location information and GMM cause value information unsolicited result code +CGREG: <stat>[,[<lac>],[<ci>],[<AcT>],[<rac>][,<cause_type>,<reject_cause>]])
<stat> : 1(registered, home network)
<lac> : "2805"(string type; two byte location area code in hexadecimal format (e.g. "00C3" equals 195 in decimal))
<ci> : "02E1ED15"(string type; four byte GERAN/UTRAN cell ID in hexadecimal format)
<AcT> : 7(E-UTRAN)

        
SYS (PCORE)    532275    3732600    09:55:30:328    NIL    [AT_R p20, s9]+CGREG: 3,4,"2805","00007113",3,"01",0,0 
=> Decode:GPRS network registration status +CGREG
<n> : 3(enable network registration, location information and GMM cause value information unsolicited result code +CGREG: <stat>[,[<lac>],[<ci>],[<AcT>],[<rac>][,<cause_type>,<reject_cause>]])
<stat> : 4(unknown (e.g. out of GERAN/UTRAN coverage))
<lac> : "2805"(string type; two byte location area code in hexadecimal format (e.g. "00C3" equals 195 in decimal))
<ci> : "00007113"(string type; four byte GERAN/UTRAN cell ID in hexadecimal format)
<AcT> : 3(GSM w/EGPRS)


----------------------------------------------------------
終端開始發生重選有對應的打印：Cell reselection procedure starts
----------------------------------------------------------
看終端當前駐留在哪一個小區上
能夠看下面關鍵信息，若是一直在4G上，好比09:51:59到09：52：19就在38400/360上，
Type    Index    Time    Local Time    Module    Message    Comment    Time Different
PS (PCORE)    38843    443753    09:51:59:896    ERRC_CEL    [CEL_DI/LV] cell camp on as serving: earfcn[38400]/pci[360], is_csg_cell[KAL_FALSE]        
PS (PCORE)    127049    742402    09:52:19:013    ERRC_CEL    [CEL_DI/LV] cell camp on as serving: earfcn[38400]/pci[340], is_csg_cell[KAL_FALSE]        
PS (PCORE)    134126    747434    09:52:19:225    ERRC_CEL    [CEL_DI/LV] cell camp on as serving: earfcn[38400]/pci[340], is_csg_cell[KAL_FALSE]        
PS (PCORE)    137080    756150    09:52:19:851    ERRC_CEL    [CEL_DI/LV] cell camp on as serving: earfcn[38400]/pci[340], is_csg_cell[KAL_FALSE]        
PS (PCORE)    210136    930246    09:52:30:849    ERRC_CEL    [CEL_DI/LV] cell camp on as serving: earfcn[38400]/pci[340], is_csg_cell[KAL_FALSE]        
PS (PCORE)    214229    959848    09:52:32:900    ERRC_CEL    [CEL_DI/LV] cell camp on as serving: earfcn[37900]/pci[309], is_csg_cell[KAL_FALSE]