GSM0408RR部分阅读的选取部分
Two service access points are defined on signalling layer 2 which are discriminated by their Service
Access Point Identifiers (SAPI) (see GSM 04.06):
i) SAPI 0: supports the transfer of signalling information including user-user information;
ii) SAPI 3: supports the transfer of user short messages.

The general purpose of Radio Resource procedures is to establish, maintain and release RR connections
that allow a point-to-point dialogue between the network and a mobile station. This includes the cell
selection/reselection and the handover procedures. Moreover, Radio Resource management procedures
include the reception of the uni-directional BCCH and CCCH when no RR connection is established. This
permits automatic cell selection/reselection.
A RR connection is a physical connection used by the two peer entities to support the upper layers’
exchange of information flows.

In idle mode no RR connection exists.
In Idle mode, upper layers can require the establishment of an RR connection

In dedicated mode, the RR connection is a physical point-to-point bi-directional connection, and includes a
SAPI 0 data link connection operating in multiframe mode on the main DCCH. If dedicated mode is
established, RR procedures provide the following services:
- establishment/release of multiframe mode on data link layer connections other than SAPI 0, on the
main DCCH or on the SACCH associated with the channel carrying the main signalling link;
- transfer of messages on any data link layer connection;
- indication of temporary unavailability of transmission (suspension, resuming);
- indication of loss of RR connection;
- automatic cell reselection and handover to maintain the RR connection;
Page 34
Draft prETS 300 940 (GSM 04.08 Part A version 5.7.0): October 1997
- setting/change of the transmission mode on the physical channels, including change of type of
channel, change of the coding/decoding/transcoding mode and setting of ciphering;
- allocation/release of an additional channel (for the TCH/H + TCH/H configuration);
- allocation/release of additional channels for multislot operation;
- release of an RR connection.

In case a change of dedicated channels is required using a dedicated assignment and handover
procedure, respectively, the RR sublayer will request the data link layer to suspend multiple frame
operation before the mobile station leaves the old channel. When the channel change has been
completed, layer 3 will request the data link layer to resume multiple frame operation again.

For SAPIs other than 0, the data link procedures described in GSM 04.06 do not provide any guarantee
against message loss or duplication.

errornumber

类似

(0, “S_OK”, “The function completed successfully”)
(0×1, “S_FALSE”, “Call successful, but returned FALSE”)
(0×2, “DXERROR_FILE_NOT_FOUND”, “The system cannot find the file specified.”)
(0×3, “DXERROR_PATH_NOT_FOUND”, “The system cannot find the path specified.”)
(0×4, “DXERROR_TOO_MANY_OPEN_FILES”, “The system cannot open the file.”)
(0×5, “DXERROR_ACCESS_DENIED”, “Access is denied.”)
(0×6, “DXERROR_INVALID_HANDLE”, “The handle is invalid.”)
(0×8, “DXERROR_NOT_ENOUGH_MEMORY”, “Not enough storage is available to process this command.”)
(0×9, “DXERROR_INVALID_BLOCK”, “The storage control block address is invalid.”)
(0xa, “DXERROR_BAD_ENVIRONMENT”, “The environment is incorrect.”)
(0xb, “DXERROR_BAD_FORMAT”, “An attempt was made to load a program with an incorrect format.”)
(0xe, “DXERROR_OUTOFMEMORY”, “The system cannot find the drive specified.”)
(0×40003, “Unknown”, “End of stream. Sample not updated.”)
(0×40103, “VFW_S_NO_MORE_ITEMS”, “The end of the list has been reached.”)
(0×4022d, “VFW_S_DUPLICATE_NAME”, “An attempt to add a filter with a duplicate name succeeded with a modified name.”)
(0×40237, “VFW_S_STATE_INTERMEDIATE”, “The state transition has not completed.”)
(0×40242, “VFW_S_PARTIAL_RENDER”, “Some of the streams in this movie are in an unsupported format.”)
(0×40245, “VFW_S_SOME_DATA_IGNORED”, “The file contained some property settings that were not used.”)
(0×40246, “VFW_S_CONNECTIONS_DEFERRED”, “Some connections have failed and have been deferred.”)
(0×40250, “VFW_S_RESOURCE_NOT_NEEDED”, “The resource specified is no longer needed.”)
(0×40254, “VFW_S_MEDIA_TYPE_IGNORED”, “A connection could not be made with the media type in the persistent graph, but has been made with a negotiated media type.”)
(0×40257, “VFW_S_VIDEO_NOT_RENDERED”, “Cannot play back the video stream: no suitable decompressor could be found.”)
(0×40258, “VFW_S_AUDIO_NOT_RENDERED”, “Cannot play back the audio stream: no audio hardware is available.”)
(0×4025a, “VFW_S_RPZA”, “Cannot play back the video stream: format ‘RPZA’ is not supported.”)
(0×40260, “VFW_S_ESTIMATED”, “The value returned had to be estimated.  It’s accuracy can not be guaranteed.”)
(0×40263, “VFW_S_RESERVED”, “This success code is reserved for internal purposes within ActiveMovie.”)
(0×40267, “VFW_S_STREAM_OFF”, “The stream has been turned off.”)
(0×40268, “VFW_S_CANT_CUE”, “The graph can’t be cued because of lack of or corrupt data.”)
(0×40270, “VFW_S_NO_STOP_TIME”, “The stop time for the sample was not set.”)
(0×4027e, “VFW_S_NOPREVIEWPIN”, “There was no preview pin available, so the capture pin output is being split to provide both capture and preview.”)
(0×40280, “VFW_S_DVD_NON_ONE_SEQUENTIAL”, “The current title was not a sequential set of chapters (PGC) and the returned timing information might not be continuous.”)
(0×4028c, “VFW_S_DVD_CHANNEL_CONTENTS_NOT_AVAILABLE”, “The audio stream did not contain sufficient information to determine the contents of each channel.”)
(0×4028d, “VFW_S_DVD_NOT_ACCURATE”, “The seek into the movie was not frame accurate.”)
(0×150005, “DV_FULLDUPLEX”, “Full duplex”)
(0×15000a, “DV_HALFDUPLEX”, “Half duplex”)
(0×150010, “DV_PENDING”, “Pending”)
(0×876086f, “D3DOK_NOAUTOGEN”, “The call succeeded but there won’t be any mipmaps generated”)
(0×878000a, “DS_NO_VIRTUALIZATION”, “The call succeeded, but we had to substitute the 3D algorithm”)
DXERROR8(0×8780014, “DS_INCOMPLETE”, “The call succeeded, but not all of the optional effects were obtained.”)
(0×8781091, “DMUS_S_PARTIALLOAD”, “The object could only load partially. This can happen if some components are not registered properly, such as embedded tracks and tools. This can also happen if some content is missing. For example, if a segment uses a DLS collection that is not in the loader’s current search directory.”)
(0×8781092, “DMUS_S_PARTIALDOWNLOAD”, “Return value from IDirectMusicBand::Download() which indicates that some of the instruments safely downloaded, but others failed. This usually occurs when some instruments are on PChannels not supported by the performance or port.”)
(0×8781200, “DMUS_S_REQUEUE”, “Return value from IDirectMusicTool::ProcessPMsg() which indicates to the performance that it should cue the PMsg again automatically.”)
(0×8781201, “DMUS_S_FREE”, “Return value from IDirectMusicTool::ProcessPMsg() which indicates to the performance that it should free the PMsg automatically.”)
(0×8781202, “DMUS_S_END”, “Return value from IDirectMusicTrack::Play() which indicates to the segment that the track has no more data after mtEnd.”)
(0×8781210, “DMUS_S_STRING_TRUNCATED”, “Returned string has been truncated to fit the buffer size.”)
(0×8781211, “DMUS_S_LAST_TOOL”, “Returned from IDirectMusicGraph::StampPMsg() this indicates that the PMsg is already stamped with the last tool in the graph. The returned PMsg’s tool pointer is now NULL.”)
(0×8781212, “DMUS_S_OVER_CHORD”, “Returned from IDirectMusicPerformance::MusicToMIDI() this indicates  that no note has been calculated because the music value has the note  at a position higher than the top note of the chord. This applies only to DMUS_PLAYMODE_NORMALCHORD play mode. This success code indicates that the caller should not do anything with the note. It is not meant to be played against this chord.”)
(0×8781213, “DMUS_S_UP_OCTAVE”, “Returned from IDirectMusicPerformance::MIDIToMusic()  and IDirectMusicPerformance::MusicToMIDI() this indicates  that the note conversion generated a note value that is below 0,  so it has been bumped up one or more octaves to be in the proper MIDI range of 0 through 127.  Note that this is valid for MIDIToMusic() when using play modes DMUS_PLAYMODE_FIXEDTOCHORD and DMUS_PLAYMODE_FIXEDTOKEY, both of which store MIDI values in wMusicValue. With MusicToMIDI() it is valid for all play modes. Ofcourse, DMUS_PLAYMODE_FIXED will never return this success code.”)
(0×8781214, “DMUS_S_DOWN_OCTAVE”, “Returned from IDirectMusicPerformance::MIDIToMusic()  and IDirectMusicPerformance::MusicToMIDI() this indicates  that the note conversion generated a note value that is above 127, so it has been bumped down one or more octaves to be in the proper MIDI range of 0 through 127.  Note that this is valid for MIDIToMusic() when using play modes DMUS_PLAYMODE_FIXEDTOCHORD and DMUS_PLAYMODE_FIXEDTOKEY, both of which store MIDI values in wMusicValue. With MusicToMIDI() it is valid for all play modes. Ofcourse, DMUS_PLAYMODE_FIXED will never return this success code.”)
(0×8781215, “DMUS_S_NOBUFFERCONTROL”, “Although the audio output from the port will be routed to the same device as the given DirectSound buffer, buffer controls such as pan and volume will not affect the output.”)
(0×8781216, “DMUS_S_GARBAGE_COLLECTED”, “The requested operation was not performed because during CollectGarbage the loader determined that the object had been released.”)
(0×8000000a, “E_PENDING”, “The data necessary to complete this operation is not yet available.”)
(0×80004001, “E_NOTIMPL”, “The function called is not supported at this time”)
(0×80004002, “E_NOINTERFACE”, “The requested COM interface is not available”)
(0×80004003, “E_POINTER”, “Invalid pointer”)
(0×80004004, “E_ABORT”, “Operation aborted”)
(0×80004005, “E_FAIL”, “An undetermined error occurred”)
(0×8000ffff, “E_UNEXPECTED”, “Catastrophic failure”)

所有内容是根据http://blog.csdn.net/moonsunearth/archive/2007/09/25/1800790.aspx整理得来的。

首先Windows mobile自带的camera程序是不支持双camera的，如果要加入双camera一个方法是在原来的程序中插入一个菜单来实现调用（经验证菜单的加入是可以实现的），另一个比较推荐的做法是使用directshow自己写一个camera程序。

切换的关键部分是通过directshow控制camera，然后驱动对切换消息进行响应，切换sensor。

Directshow对camera控制的接口如下：

LRESULT hr;

     CComPtr<IAMCameraControl> pCameraControl;

long lCurrentVal,lCurrentFlags;

long CameraControl_Switch=CameraControl_Flash+0xff;

if(sensor>=SENSOR_MAX)
return FALSE;

     CHK(m_pVideoCapFilter->QueryInterface(&pCameraControl));

     CHK(pCameraControl->Get(CameraControl_Switch, &lCurrentVal, &lCurrentFlags));
if(lCurrentVal == sensor)
…{
//return TRUE;
     }
   CHK(pCameraControl->Set(CameraControl_Switch, sensor, CameraControl_Flags_Manual));

IAMCameraControl::Set函数会调用CAM_IOControl，Ioctl=IOCTL_CS_PROPERTY这个是让驱动进行响应的关键。

在CAM_IOControl函数中对应的IOCTL_CS_PROPERTY中的部分是

else if ( TRUE == IsEqualGUID( pCsProp->Set, PROPSETID_VIDCAP_CAMERACONTROL ) )

{

dwErr = pCamDevice->AdapterHandleCamControlRequests( pInBuf,InBufLen, pOutBuf, OutBufLen, pdwBytesTransferred );

}

对于我们代码的添加一个是在这里添加一个自己的customer函数，另一个方法是继续向上层走，然后在上层添加自己的函数。不过因为这里是mdd层，所以最好不要修改，放到pdd层。

整个的流程的修改基本上就是这么多了。

在驱动层需要实现不同camera sensor的切换，然后上层通过directshow的IAMStreamConfig实现。

CComPtr<IAMStreamConfig> pStremConfig;

    CHK(m_pCapGraphBuilder->FindInterface(&PIN_CATEGORY_CAPTURE, 0, m_pVideoCapFilter, IID_IAMStreamConfig, (void **)&pStremConfig))

    CHK(pStremConfig->GetNumberOfCapabilities(&iCount, &iSize));

if (iSize == sizeof(VIDEO_STREAM_CONFIG_CAPS))
…{
for (int iFormat = 0; iFormat < iCount; iFormat++)
…{
            VIDEO_STREAM_CONFIG_CAPS scc;
            AM_MEDIA_TYPE *pmtConfig;

CHK(pStremConfig->GetStreamCaps(iFormat, &pmtConfig, (BYTE*)&scc));
if (SUCCEEDED(hr))
…{
if(scc.MinOutputSize.cx == pSize->cx && scc.MinOutputSize.cy == pSize->cy)
…{
                    CHK(pStremConfig->SetFormat(pmtConfig));
                    DeleteMediaType(pmtConfig);
break;
                }
                DeleteMediaType(pmtConfig);
            }
        }
    }

如果支持GPRS（General Packet Radio Service）点到点服务功能，RR子层还包括管理包数据物理通道（Packet data physical channels）。

如果支持VGCS（Voice Group Call Service）和VBS（Voice Broadcast Service）功能，RR子层还包括守听NCH（Notification Channel）通道的功能，以及获取及释放组呼（Voice Group Call）通道的功能。

2. 当有RR connection存在时MM发送RR_DATA_REQ给RR，当没有RR connection存在时MM发送RR_ESTABLISH_REQ给RR。

3. 当RR connection确立时，MM会开启T3240 timer同时等待网络的回应。

4. 当一切正确时，网络会通过RR返回RR_ESTABLISH_CNF给MM。

5. 当网络可以提供MMI/CM所要求的服务时，RR/DL会发送RR_DATA_IND(CM SERVICE ACCEPT)给MM。

6. 接着RR/DL会发送RR_SYNC_IND(ciphering on)给MM。

7. MM返回MMXX_ESTABLISH_CNF给MMI/CM。

如果T3240超时而网络没有响应时，MM会向RR发送RR_ABORT_REQ，然后向MMI/CM发送MMXX_RELEASE_IND

当MM在注册网络时，网络会发送Authentication的请求。这个请求是通过RR_DATA_IND（AUTHENTICATION REQUEST)发送给MM。在这个原语中带有从网络发送过来的Random Number (RAND)。MM会通过SIM_AUTHENTICATION_REQ这个原语将RAND发送给SIM。SIM会执行RUN GSM ALGORITHM.这个命令，根据得到的RAND计算出SRES 和Kc，然后通过SIM_AUTHENTICATION_CNF发送给MM。MM得到这些数据后会通过RR_DATA_REQ(AUTHENTICATION RESPONSE)，RR_SYNC_REQ (ciphering parameters)发送给RR，然后传送给网络。网络会比较传送过来的SRES 和自己计算出来的SRES 来作为Authentication的依据。Kc会被ME端用作以后同网络进行enciphered。

SIM响应MM的SIM_AUTHENTICATION_REQ代码流程如下：

if (SIM_IS_FLAG_SET (GSM_DATAFIELD))

error = FKT_Select (SIM_DF_GSM, NULL, 0);

else

error = FKT_Select (SIM_DF_1800, NULL, 0);

//需要注意的是SIM在执行RUN GSM ALGORITHM时需要先选中DFGSM

if (error EQ SIM_NO_ERROR)

error = FKT_RunGSMAlgo (sim_authentication_req->rand, response, SIM_GSM_ALG_LEN);

////////////////////////////////////

// FKT_RunGSMAlgo这个函数的实现如下

sw1sw2 = SIM_RunGSMAlgo ((UBYTE *)response,

(UBYTE *)rand,

&size);

error = FKT_convert_error (sw1sw2, size);

if (error EQ SIM_NO_ERROR)

error = FKT_GetResponse (data, len);

return error;

// SIM_RunGSMAlgo函数就是直接封装SIM的COMMAND SIM_RUN_GSM_ALGO然后发送给SIM

///////////////////////////////////////////

PSENDX (MM, sim_authentication_cnf);

error = FKT_Select (SIM_KC, NULL, 0);

if (error EQ SIM_NO_ERROR)

{

kc_n.c_kc = MAX_KC_N;

FKT_UpdateBinary (kc_n.kc, (USHORT)kc_n.c_kc, 0);

}

//发送给MM后，会继续选中SIM_KC更新该EF。

如果Location Update被接受，则RR会返回如下原语

MM在处理RR_DATA_IND（Location Update Accept）是会先停掉Timer T3212，T3210，然后将MM的 mm_data->reg.update_stat = MS_UPDATED;

在RR_DATA_IND中会带有Mobile Identity的类型。Mobile Identity的类型可能是TMSI，IMSI，IMEI或者为空

MM对应不同的Mobile Identity处理如下：

MM会先reallocation TMSI，然后将RR_DATA_IND中的TMSI保存在MM信息的reg.tmsi中，然后向RR发送BSIZE_U_TMSI_REALLOC_COMP，保存RR_DATA_IND的lai信息，然后发送RR_SYNC_REQ（rr_sync_req_tmsi），最后发送RR_SYNC_REQ (Location Area allowed)。

对应代码如下：

MCAST (tmsi_realloc_comp, U_TMSI_REALLOC_COMP);

/* Save TMSI in MM registration data */

mm_store_tmsi (&loc_upd_accept->mob_id);

/* Send RR_DATA_REQ (TMSI_REALLOC_COMPLETE) */

tmsi_realloc_comp->msg_type = U_TMSI_REALLOC_COMP;

for_data_req (BSIZE_U_TMSI_REALLOC_COMP);

mm_data->reg.lai = loc_upd_accept->loc_area_ident;

/* Send RR_SYNC_REQ */

mm_build_rr_sync_req_tmsi ();

/* Send RR_SYNC_REQ (Location Area allowed) */

mm_build_rr_sync_req_cause (SYNCCS_LAI_ALLOW);

MM会先删除存储的TMSI，保存RR_DATA_IND的lai信息，然后通过RR_SYNC_REQ向RR说明TMSI已经失效，最后发送RR_SYNC_REQ (Location Area allowed)。

对应代码如下：

mm_data->reg.tmsi = TMSI_INVALID_VALUE;

mm_build_rr_sync_req_cause (SYNCCS_TMSI_INVAL);

mm_data->reg.lai = loc_upd_accept->loc_area_ident;

mm_build_rr_sync_req_cause (SYNCCS_LAI_ALLOW);

MM只会创建一个BSIZE_B_MM_STATUS发送给RR,MM似乎会将这个mobile identity忽略掉。

对应代码如下:

MCAST (mm_status, B_MM_STATUS);

mm_build_mm_status (RC_INCORRECT_MESSAGE, mm_status);

for_data_req (BSIZE_B_MM_STATUS);

MM直接向RR发送RR_SYNC_REQ (Location Area allowed)。

对应代码如下：

mm_data->reg.lai = loc_upd_accept->loc_area_ident;

mm_build_rr_sync_req_cause (SYNCCS_LAI_ALLOW);

需要发送MMR_NREG_REQ的情况有如下3种。CS_SIM_REM，CS_POW_OFF，CS_SOFT_OFF。

这个过程将会进行如下操作

TIMERSTOP (T3212);

然后调用mm_mmr_nreg_req函数进行处理。

对于此时MM处于不同的状态，MM会执行对应的操作。

MM_NULL:

CS_POW_OFF和CS_SOFT_OFF会先清除register data，复制sim发给mm的sim_insert_info到mm的register data中，然后清除sim_insert_info然后向GMM发送MMGMM_NREG_CNF原语。

CS_SIM_REM也会清除register data，然后会对是否需要再次注册进行判断，然后向GMM发送MMGMM_NREG_IND原语，最后如果STATE_REG_TYPE为REG_REMOTE_CONTROLLED的话，会将STATE_REG_TYPE设置为REG_CELL_SEARCH_ONLY，STATE_GPRS_CM_EST为CM_GPRS_EST_IDLE。

MM_LUP_INITIATED，MM_LUP_REJECTED：

先向RR发送RR_SYNC_REQ，然后设置状态为MM无效的update state。然后执行同MM状态为MM_WAIT_FOR_OUTG_MM_CONN，MM_CONN_ACTIVE，MM_PROCESS_PROMPT，MM_WAIT_FOR_NW_CMD一样的操作。

MM_WAIT_FOR_OUTG_MM_CONN，MM_CONN_ACTIVE，MM_PROCESS_PROMPT，MM_WAIT_FOR_NW_CMD：

如果MM此时允许attach，ms已经updated，detach_done为MMGMM_PERFORM_DETACH则进行如下操作

先将所有CM connections的类型为CM_NOT_IDLE的连接释放。停止timer T3210，T3211，T3212，T3213，T3230，T3240，然后向RR发送imsi_detach_message，启动timer T3220，将MM状态设置为MM_IMSI_DETACH_INIT。

如果MM状态不满足要求则执行同MM状态为MM_WAIT_FOR_RR_CONN_LUP，MM_WAIT_FOR_RR_CONN_MM，MM_WAIT_FOR_REESTABLISH一样的操作。

MM_WAIT_FOR_RR_CONN_LUP，MM_WAIT_FOR_RR_CONN_MM，MM_WAIT_FOR_REESTABLISH：

依然先将所有CM connections的类型为CM_NOT_IDLE的连接释放，停止timer T3210，T3211，T3212，T3213，T3230，T3240，如果是CS_POW_OFF和CS_SOFT_OFF则会向RR发送RR_ABORT_REQ，原因设置为normal abort，而CS_SIM_REM则会将原因设置为sim remove。最后将MM状态设置为MM_IMSI_DETACH_INIT。

MM_IMSI_DETACH_INIT，MM_WAIT_FOR_RR_CONN_DETACH：

设置mm_data->nreg_cause = nreg_cause;

MM_WAIT_FOR_RR_ACTIVE：RR is searching for a cell

为什么此时RR is searching for a cell？根据04.08

“If no RR connection exists, the MM sublayer within the mobile

* station will request the RR sublayer to establish a RR

* connection. If establishment of the RR connection is not possible

* because a suitable cell is not (or not yet) available then, the

* mobile station shall try for a period of at least 5 seconds and for

* not more than a period of 20 seconds to find a suitable cell. If a

* suitable cell is found during this time then, the mobile station shall

* request the RR sublayer to establish an RR connection, otherwise the

* IMSI detach is aborted.

CS_POW_OFF和CS_SOFT_OFF向DL层发送MDL_RELEASE_REQ（SAPI 0），这个其实应该是RR层做的。接着向RR发送RR_DEACTIVATE_REQ，清除register data，停止所有MM timer，最后将MM状态设置为MM_NULL。最后还会执行MM状态为MM_NULL同样的操作。

CS_SIM_REM先向RR发送RR_ABORT_REQ，原因是sim remove，然后执行MM状态为MM_NULL同样的操作。

MM_LOCATION_UPDATING_PENDING，MM_IMSI_DETACH_PENDING，MM_IDLE_LUP_NEEDED，
MM_IDLE_NORMAL_SERVICE，MM_IDLE_ATTEMPT_TO_UPDATE：
停止timer T3212，T3213。如果MM此时允许attach，ms已经updated，detach_done为MMGMM_PERFORM_DETACH则创建imsi_detach_message，然后处理mobile originated call by SS or SMS，设置状态为MM_WAIT_FOR_RR_CONN_DETACH。

如果MM状态不满足要求则执行同MM状态为MM_IDLE_LIMITED_SERVICE，MM_IDLE_NO_IMSI同样的操作。

MM_IDLE_LIMITED_SERVICE，MM_IDLE_NO_IMSI：

停止timer T3211，T3212，T3213。CS_POW_OFF和CS_SOFT_OFF先向DL层发送MDL_RELEASE_REQ（SAPI 0），接着向RR发送RR_DEACTIVATE_REQ，清除register data，设置MM状态为NO_SERVICE。

CS_SIM_REM先向DL层发送MDL_RELEASE_REQ（SAPI 0），然后向RR发送RR_ABORT_REQ，原因是sim remove，清除register data，如果(mm_data->mm_idle_no_imsi_marker EQ 0)则mm_data->mm_idle_no_imsi_marker = 17;设置MM状态为MM_IDLE_NO_IMSI，执行同MM状态为MM_NULL同样的操作，不过将service改为LIMITED_SERVICE。

MM_IDLE_NO_CELL_AVAILABLE：

基本上同MM_IDLE_LIMITED_SERVICE，MM_IDLE_NO_IMSI一样，只是CS_SIM_REM最后的service不是LIMITED_SERVICE而是NO_SERVICE。

MM_IDLE_PLMN_SEARCH，MM_PLMN_SEARCH_NORMAL_SERVICE：

返回network search开始时MM的状态

SET_STATE (STATE_MM, mm_data->idle_substate);

然后再次调用本函数进行状态处理。

mm_mmr_nreg_req (nreg_cause, detach_done);

总的从代码中看来，当MM接收到从RR传送过来的RR_ACTIVATE_CNF原语后，MM会存储RR传过来的一些诸如plmn，lac，mm_info等信息，同时会通知SIM更新plmn，bcch，kc等等信息，如果此时不需要location update，MM会向GMM发送MMGMM_ACTIVATE_IND，此时是MMGMM_FULL_SERVICE。当需要location update时，根据update的类型，向RR发送RR_ESTABLISH_REQ原语。

MM接收到该原语后会根据自己当前的状态进行状态的更新，MM_IDLE_NORMAL_SERVICE或MMGMM_WAIT_FOR_UPDATE，或者没有sim或sim无效的MM_IDLE_LIMITED_SERVICE，MM_IDLE_NO_IMSI。