MMR_NREG_REQ

需要发送MMR_NREG_REQ的情况有如下3种。CS_SIM_REM，CS_POW_OFF，CS_SOFT_OFF。

这个过程将会进行如下操作

TIMERSTOP (T3212);

然后调用mm_mmr_nreg_req函数进行处理。

对于此时MM处于不同的状态，MM会执行对应的操作。

MM_NULL:

CS_POW_OFF和CS_SOFT_OFF会先清除register data，复制sim发给mm的sim_insert_info到mm的register data中，然后清除sim_insert_info然后向GMM发送MMGMM_NREG_CNF原语。

CS_SIM_REM也会清除register data，然后会对是否需要再次注册进行判断，然后向GMM发送MMGMM_NREG_IND原语，最后如果STATE_REG_TYPE为REG_REMOTE_CONTROLLED的话，会将STATE_REG_TYPE设置为REG_CELL_SEARCH_ONLY，STATE_GPRS_CM_EST为CM_GPRS_EST_IDLE。

MM_LUP_INITIATED，MM_LUP_REJECTED：

先向RR发送RR_SYNC_REQ，然后设置状态为MM无效的update state。然后执行同MM状态为MM_WAIT_FOR_OUTG_MM_CONN，MM_CONN_ACTIVE，MM_PROCESS_PROMPT，MM_WAIT_FOR_NW_CMD一样的操作。

MM_WAIT_FOR_OUTG_MM_CONN，MM_CONN_ACTIVE，MM_PROCESS_PROMPT，MM_WAIT_FOR_NW_CMD：

如果MM此时允许attach，ms已经updated，detach_done为MMGMM_PERFORM_DETACH则进行如下操作

先将所有CM connections的类型为CM_NOT_IDLE的连接释放。停止timer T3210，T3211，T3212，T3213，T3230，T3240，然后向RR发送imsi_detach_message，启动timer T3220，将MM状态设置为MM_IMSI_DETACH_INIT。

如果MM状态不满足要求则执行同MM状态为MM_WAIT_FOR_RR_CONN_LUP，MM_WAIT_FOR_RR_CONN_MM，MM_WAIT_FOR_REESTABLISH一样的操作。

MM_WAIT_FOR_RR_CONN_LUP，MM_WAIT_FOR_RR_CONN_MM，MM_WAIT_FOR_REESTABLISH：

依然先将所有CM connections的类型为CM_NOT_IDLE的连接释放，停止timer T3210，T3211，T3212，T3213，T3230，T3240，如果是CS_POW_OFF和CS_SOFT_OFF则会向RR发送RR_ABORT_REQ，原因设置为normal abort，而CS_SIM_REM则会将原因设置为sim remove。最后将MM状态设置为MM_IMSI_DETACH_INIT。

MM_IMSI_DETACH_INIT，MM_WAIT_FOR_RR_CONN_DETACH：

设置mm_data->nreg_cause = nreg_cause;

MM_WAIT_FOR_RR_ACTIVE：RR is searching for a cell

为什么此时RR is searching for a cell？根据04.08

“If no RR connection exists, the MM sublayer within the mobile

* station will request the RR sublayer to establish a RR

* connection. If establishment of the RR connection is not possible

* because a suitable cell is not (or not yet) available then, the

* mobile station shall try for a period of at least 5 seconds and for

* not more than a period of 20 seconds to find a suitable cell. If a

* suitable cell is found during this time then, the mobile station shall

* request the RR sublayer to establish an RR connection, otherwise the

* IMSI detach is aborted.

CS_POW_OFF和CS_SOFT_OFF向DL层发送MDL_RELEASE_REQ（SAPI 0），这个其实应该是RR层做的。接着向RR发送RR_DEACTIVATE_REQ，清除register data，停止所有MM timer，最后将MM状态设置为MM_NULL。最后还会执行MM状态为MM_NULL同样的操作。

CS_SIM_REM先向RR发送RR_ABORT_REQ，原因是sim remove，然后执行MM状态为MM_NULL同样的操作。

MM_LOCATION_UPDATING_PENDING，MM_IMSI_DETACH_PENDING，MM_IDLE_LUP_NEEDED，
MM_IDLE_NORMAL_SERVICE，MM_IDLE_ATTEMPT_TO_UPDATE：
停止timer T3212，T3213。如果MM此时允许attach，ms已经updated，detach_done为MMGMM_PERFORM_DETACH则创建imsi_detach_message，然后处理mobile originated call by SS or SMS，设置状态为MM_WAIT_FOR_RR_CONN_DETACH。

如果MM状态不满足要求则执行同MM状态为MM_IDLE_LIMITED_SERVICE，MM_IDLE_NO_IMSI同样的操作。

MM_IDLE_LIMITED_SERVICE，MM_IDLE_NO_IMSI：

停止timer T3211，T3212，T3213。CS_POW_OFF和CS_SOFT_OFF先向DL层发送MDL_RELEASE_REQ（SAPI 0），接着向RR发送RR_DEACTIVATE_REQ，清除register data，设置MM状态为NO_SERVICE。

CS_SIM_REM先向DL层发送MDL_RELEASE_REQ（SAPI 0），然后向RR发送RR_ABORT_REQ，原因是sim remove，清除register data，如果(mm_data->mm_idle_no_imsi_marker EQ 0)则mm_data->mm_idle_no_imsi_marker = 17;设置MM状态为MM_IDLE_NO_IMSI，执行同MM状态为MM_NULL同样的操作，不过将service改为LIMITED_SERVICE。

MM_IDLE_NO_CELL_AVAILABLE：

基本上同MM_IDLE_LIMITED_SERVICE，MM_IDLE_NO_IMSI一样，只是CS_SIM_REM最后的service不是LIMITED_SERVICE而是NO_SERVICE。

MM_IDLE_PLMN_SEARCH，MM_PLMN_SEARCH_NORMAL_SERVICE：

返回network search开始时MM的状态

SET_STATE (STATE_MM, mm_data->idle_substate);

然后再次调用本函数进行状态处理。

mm_mmr_nreg_req (nreg_cause, detach_done);

GLOBAL const void mm_rr_activate_cnf (T_RR_ACTIVATE_CNF *rr_activate_cnf)

{

mm_data->rf_power = rr_activate_cnf->power;

mm_data->reg.new_cell_ind = TRUE;

//如果mnc和mcc是请求的则复制plmn。

if (reg_plmn_equal_eqv (&rr_activate_cnf->plmn, &mm_data->reg.actual_plmn))

{

mm_data->reg.actual_plmn = rr_activate_cnf->plmn; /* Struct copy */

}

//此时MM的状态如果是MM_WAIT_FOR_RR_ACTIVE，同时(mm_data->reg.op.func EQ rr_activate_cnf->op.func)

//rr_activate_cnf->op.service中返回了当前的service类型是LIMITED_SERVICE或FULL_SERVICE。

//当时FULL_SERVICE时会进行如下的操作。

//将mm_info，lai，lac，cid，gprs_indication赋值到MM对应的变量中。

mm_copy_rr_act_cnf_data (rr_activate_cnf);

//此时会判断需不需要location updating，判读函数如下

mm_normal_upd_needed()

if (mm_data->reg.update_stat EQ MS_UPDATED AND

mm_check_lai (&mm_data->reg.lai, &mm_data->mm.lai))

return FALSE;

return TRUE;

mm_attach_upd_needed()

if (mm_data->mm.mm_info.att EQ ATT_ALLOW AND mm_data->first_attach) 

return TRUE;

return FALSE;

mm_periodic_upd_needed (void)

if (mm_data->t3212_timeout AND mm_data->mm.mm_info.t3212 NEQ 0)

return TRUE;

return FALSE;

当不需要location updating时

{

TIMERSTOP (T3213);

mm_data->t3213_restart = 0;

mm_change_t3212();

//然后向GMM发送MMGMM_REG_CNF原语

reg_mm_success (FULL_SERVICE);

//向SIM发送 SIM_MM_UPDATE_REQ 原语 其中主要需要更新的有loc_info，bcch_info，forb_plmns，kc。

reg_build_sim_update (); /* Update cell id */

//同时如果不是gsm only此时还要向GMM发送MMGMM_ACTIVATE_IND。传递的参数有plmn,lac,cid,status, gprs_indicator,同时3212timer时间如下设置

if (mm_data->t3212_cfg_counter NEQ 0 AND 

mm_data->mm.mm_info.t3212 NEQ 0)

mmgmm_activate_ind->t3212_val = mm_data->t3212_cfg_counter * 10000;

else

mmgmm_activate_ind->t3212_val = mm_data->mm.mm_info.t3212 * 360000;

mm_mmgmm_activate_ind (MMGMM_FULL_SERVICE);

/* Back to MM_IDLE_NORMAL_SERVICE */

mm_data->idle_entry = RRCS_INT_NOT_PRESENT;

/* Remember MM doesn't need any IMSI ATTACH anymore */

if (mm_lup_allowed_by_gmm() AND mm_data->first_attach )

{

mm_data->first_attach_mem = mm_data->first_attach;

mm_data->first_attach = FALSE;

}

mm_data->t3212_timeout = FALSE;

mm_data->loc_upd_type.lut = NOT_RUNNING;

SET_STATE (STATE_MM, MM_IDLE_NORMAL_SERVICE);

/* Check HPLMN timer state */

reg_check_hplmn_tim (mm_data->reg.thplmn);

USE_STORED_ENTRIES();

//当需要location updating时进行如下操作。

reg_mm_cell_selected ();//gsm only情况下

mm_data->attempt_cnt = 0;

//然后判断mm_normal_upd_needed()还是mm_attach_upd_needed()还是其他

if (mm_normal_upd_needed())

{

/*

* If updating is allowed by GMM, start procedure,

* otherwise enter state MM_IDLE_LUP_NEEDED.

*/

mm_normal_loc_upd ();

//如果GMM允许location update，此时会向RR发送RR_ESTABLISH_REQ原语，当然此时需要一个RR的连接。

mm_rr_est_req (ESTCS_SERV_REQ_BY_MM, NO_CM_SERVICE, 0);

TIMERSTOP (T3211);

TIMERSTOP (T3213);

mm_data->t3213_restart = 0;

SET_STATE (STATE_MM, MM_WAIT_FOR_RR_CONN_LUP);

}

else if (mm_attach_upd_needed())

{

/*

* If updating is allowed by GMM, start procedure,

* otherwise enter state MM_IDLE_LUP_NEEDED.

*/

mm_attach_loc_upd ();

//此时同mm_normal_upd_needed一样，只是mm_start_loc_upd的参数由NORMAL_LUP变为了IMSI_ATTACH_LUP，依然是发送RR_ESTABLISH_REQ原语

}

//除了mm_normal_upd_needed和mm_attach_upd_needed其他情况mm_start_loc_upd的参数变为了PERIODIC_LUP。

//最后也会进行如下调用

mm_mmgmm_activate_ind (MMGMM_WAIT_FOR_UPDATE);

}

总的从代码中看来，当MM接收到从RR传送过来的RR_ACTIVATE_CNF原语后，MM会存储RR传过来的一些诸如plmn，lac，mm_info等信息，同时会通知SIM更新plmn，bcch，kc等等信息，如果此时不需要location update，MM会向GMM发送MMGMM_ACTIVATE_IND，此时是MMGMM_FULL_SERVICE。当需要location update时，根据update的类型，向RR发送RR_ESTABLISH_REQ原语。

MM接收到该原语后会根据自己当前的状态进行状态的更新，MM_IDLE_NORMAL_SERVICE或MMGMM_WAIT_FOR_UPDATE，或者没有sim或sim无效的MM_IDLE_LIMITED_SERVICE，MM_IDLE_NO_IMSI。

Registration

因为TI的代码中是定义了GPRS的，当有GMM模块时，网络的注册是和单纯只有MM模块是不一样的，我们先只看当没有GMM时，MM是如何进行网络注册的。

MMI最后会调用GLOBAL SHORT psaMM_Registrate ( void )来进行网络注册。

GLOBAL SHORT psaMM_Registrate ( void )

{

psaMM_SetRegMode ( MODE_AUTO );

PALLOC (mmr_reg_req, MMR_REG_REQ);

//根据sim的状态来决定当前的网络服务。

if (simShrdPrm.imei_blocked EQ TRUE)

{

mmr_reg_req->service_mode = SERVICE_MODE_LIMITED;

}

else

{

mmr_reg_req->service_mode = SERVICE_MODE_FULL;

}

//以下代码实现了向MM发送了一个MMR_REG_REQ原语。

PSENDX (MM, mmr_reg_req);

}

frstFlg = FALSE;

return 0;

}

MMR_REG_REQ原语在MM的处理函数是reg_mmr_reg_req。这个函数中只有一个调用

mm_func_mmgmm_reg_req (mmr_reg_req->service_mode, 

REG_GPRS_INACTIVE,

MMGMM_CLASS_CC);

因为我们跟踪的代码是GSM only，所以现在的网络类型是MMGMM_CLASS_CC即GSM only

网络的类型定义如下：

#define VAL_MOBILE_CLASS___DEF (0x0) /* Combined GPRS attach */

#define MMGMM_CLASS_A (0x1) /* Combined GPRS */

#define MMGMM_CLASS_B (0x2) /* GPRS and GSM */

#define MMGMM_CLASS_BC (0x3) /* Combined GPRS if possible, otherwise GSM only */

#define MMGMM_CLASS_BG (0x4) /* Combined GPRS if possible, otherwise GPRS only */

#define MMGMM_CLASS_CC (0x5) /* GSM-only */

#define MMGMM_CLASS_CG (0x6) /* GPRS-only */

mm_func_mmgmm_reg_req函数中如果是GSM only则会调用 mm_reg_gsm_only_req (service_mode); Read the rest of this post »

最终目的是实现一个类似可运行程序的框架的东西。
难点：如何生成这个可运行的程序数据。1.函数的跳转使用一个固定的地址中的函数指针实现。2.将程序数据解析成一行行的执行代码。
同时应该同应用程序的编译平台的实现有着直接的联系。
现在看起来第二种方式的实现应该还是简单点，同时可以做到不同平台的开发。当一个应用调试完成后，可以使用特殊的处理将源文件生成一个数组，然后在不同的另一个平台上只需要对该数组进行一次解析，将对应的数据转化为对应的具体平台的函数调用就可以实现同开发平台上同样的运行效果了。

对于第一种实现方式，主要的难点是需要对所有可能调用的api都要进行地址固定。这个可以通过一个全局的函数指针数组来实现跳转，开发时必须使用函数指针进行。在进行平台移植时，这个函数指针数组必须指定一个绝对的地址，同时这个地址与开发的应用程序或动态加载系统实现的对应的lib中的地址必须要一致，否则函数会跳转到错误的地址上。
分析下来看来都是可以实现的，个人觉得第二种方式可能会简单一点。

Mobility Management Services
The services offered by mobility management are described in the following:

Registration
After power-on or SIM insertion the mobile station searches for a cell and tries to register on it. Selecting
a network is the sense of the registration procedure.

Normal Location Updating
If the mobile station is not registered by the network or changes a location area a normal location updating
is processed. That means the registration by the network is updated.

Periodic Location Updating
If the network uses periodic location updating this procedure is used by the mobile station to update its
registration by the network in periodic times.

IMSI Attach
If indicated by the network the mobile station updates its registration after initial cell selection althought
the SIM card shows the updated state.

IMSI Detach
If indicated by the network the mobile station de-registers itself during SIM removing or power-off.

TMSI Reallocation
The TMSI Reallocation procedure is used by the network to assign a new or changed temporary subscriber
identity to the mobile station.

Authentication
The authentication procedure is used to calculate and compare the authentication parameter.
Identification
The base station uses the identication procedure to request the various identifications from a mobile
station.

MM-Connection Management
MM handles the various connections from call control, supplementary services and short message
services.

Net Request
The net request procedure requests all available networks and presents it to the man machine interface.

如图，MM各个状态的转换和条件。

Overview

This section offers a brief description of the different layers which constitute the mobile station Protocol Stack. It is also intended to offer an overview of the intersystem interface. The Protocol Stacks are used to define the functionality of the GSM protocols for interfaces. The GSM specifications are normative when used to describe the functionality of interfaces, but the stacks and the subdivision of protocol layers do not imply or restrict any implementation.

1 PL - Physical Layer

The base of the Protocol Stack rests on the physical layer.

2 DL - Data Link

The Data Link Layer (DL) is used to handle an acknowlowdged connection between mobile and base station. The LAPDm protocol is used.

3 RR - Radio Resource

Radio Resource (RR) manages the resources of the air-interface. That means configuration of physical layer, cell selection and cell reselection, data transfer, RR-Connection handling.

4 MM - Mobility Management

Mobility Management (MM) handles registration aspects for the mobile station. It detects changes of location areas and updates a mobile station in the new location area.

5 CC - Call Control

Call Control (CC) provides the call functionality. This includes call establishment, call maintenance

procedures like Hold, Retrieve or Modify, and call disconnection.

6 SS - Supplementary Services

Supplementary Services (SS) handles all call independent supplementary services like call forwarding or call barring.

7 SMS - Short Message Services

Short Message Services (SMS) is used for sending and receiving point-to-point short messages. Additionally the reception of cell broadcast short messages is included. Call Control (CC), Supplementary Services (SS) and Short Message Services (SMS) together are referred to as Connection Management (CM) sometimes.

8 MMI - Man Machine Interface

The man machine interface (MMI) is the interface to the user. Normally it is connected with a keypad as input device and a display as output device. In G23, there is a AT Command Interpreter (ACI), therefore, sometimes the MMI is also referred to as ACI in the present document if “the layer above layer 3″ is to be identified.

Between the several entities data interfaces are defined. These data interfaces are called Service

Access Points (SAPs), indicating that an upper layer uses the services of a lower layer.

The GSM specification do not set out any implementation of the Protocol Stack. The following diagrams show the implementation described in all these documents for the mobile station. All entities Technical Document GSM Protocol Stack Message Sequence Charts MM (6147.203.97.102), v0.3 Draft

except the Man Machine Interface and Physical Layer are implemented as part of the Protocol Stack - with ACI seen as an integral part of the stack in almost all cases.

For GPRS, there are more entities.

9 GRR (RLC/MAC) – Radio Link Control/Medium Access Control

This layer contains two functions: The Radio Link Control function provides a radio-solution-dependent reliable link. The Medium Access Control function controls the access signalling (request and grant) procedures for the radio channel, and the mapping of LLC frames onto the GSM physical channel.

10 LLC – Logical Link Control

The LLC entity provides multiple highly reliable logical links for asynchronous data transfer between the MS and the network. It supports variable-length information frames, acknowledged and unacknowledged data transfer, flow and sequence control,error detection and recovery, notification of unrecoverable errors, user identity confidentiality, and ciphering of user and signaling data.

11 GMM – GPRS Mobility Management

The GMM entity provides procedures for the mobility of the MS, such as informing the network of its present location, and user identity confidentiality. It manages the GMM context (attach, detach, routing area updating), supports security functions such as authentication of user and MS, controls ciphering of data, and initiates the response to paging messages.

12 SM – Session Management

The main function of the session management (SM) is to support PDP context handling of the user terminal. Session Management activates, modifies and deletes the contexts for packet data protocols (PDP). Session Management services are provided at the SMREG-SAP and the SNSM-SAP for anonymous and non-anonymous access. The non-anonymous and anonymous access procedures for PDP context activation and PDP context deactivation are available at the SMREG-SAP.In addition there exists a PDP context modification for non-anonymous PDP contexts.

13 SNDCP - Subnetwork Dependant Convergence Protocol

SNDCP carries out all functions related to transfer of Network layer Protocol Data Units (N-PDUs) over GPRS in a transparent way. SNDCP helps to improve channel efficiency by means of compression techniques. The set of protocol entities above SNDCP consists of commonly used network protocols. They all use the same SNDCP entity, which then performs multiplexing of data coming from different sources to be sent using the service provided by the LLC layer.

14 GACI – GPRS Application Control Interface

The GACI is the GPRS extension of the ACI. It is specified in GSM 07.07 and 07.60. It is responsible for processing of the GPRS related AT Commands to setup, activate and deactivate the PDP context parameter. It also provides functionality for the interworking between GMM/SM/SNDCP and a packet oriented protocol like PPP.

15 GSMS - GPRS Short Message Service

Like GACI, GSMS, the GPRS Short Message Service, is also not a new entity of its own, but it is the GSM SMS entity enhanced by GPRS functionality.

（1）当内核完成它自己内部由一些目标依赖部分组成的启动程序后，它将调用Application_Initialize()函数，这是实体进入内核所有应用程序的入口点。

（2）调用在Application_Initialize()函数中StartFrame（）函数。这是实体对于框架来说的主要的进入点。StartFrame（）主要负责内存池的创建，任务中实体任务的创建，启动作为当前应用程序一部分的任务。

（3）用于进行通信的分区内存池通过os_CreateParti tionPool()的调用而被创建。不同分区的大小和数目用户可以通过修改配置文件xxxconst.h来进行控制。

（4）如同任务的堆栈的内存分配一样，队列内存的分配是通过os_CreateMemoryPool()而得到的，它的大小也可以通过调整xxxconst.h而进行改变。

（5）在xxxcomp.c中有一张包含了所有在应用程序中的实体的pei_create（）函数地址的表。实体可能以一个单独的任务运行也可能是共享一个任务。框架调用每一个pei_create函数并根据该函数的参数而创建一个实体。

（6）调用os_CreateTask()而创建一个任务。

（7）当所有任务都被创建后，框架像创建他们一样也使用相同的启动命令来启动他们。在进一步的初始化（如L1层和他的驱动）后，Application_Initialize()将会返回，内核中的调度将会被激活。

（8）任务根据他们的优先级不同而依次被调度。对于所有的任务来说，这里只有一个任务实体的函数。每个任务它都只被调用一次。每个任务都有它自己的堆栈空间和处理由所有框架函数通过pf_TaskEntry()发出的请求。

（9）在任务中每个实体函数消息队列通过os_CreateQueue()的调用而被创建。队列中实体的数量是通过pei_create()中输出的结构体而得知。

（10）pei_init()被调用。它的函数地址也是通过pei_create()中输出的结构体而得知。

（11）在pei_init()中当前被调度的实体同其他实体进行通信的通信通道被打开。这是通过调用vsi_c_open()来完成的。打开一个通信通道意味着向框架请求得到队列中的那些实体的句柄。如果一个实体的句柄因为相应的任务没有被调度而不能被请求，这时pei_init()将会返回一个错误信息，当前活动的任务将会被阻塞100ms以使内核能够调度比当前任务优先权低的任务。然后pei_init()将再次被调用。当所有被请求的句柄都被得到后，一个内部的数据库将通过pei_init()而被初始化。.

（12）如果与一个任务进行通信的所有的任务并没有都被调度，那么该任务可能被阻塞。

（13）如果一个任务在一个活动的主体中运行，pei_run将被调用。实体的主要循环也包含在pei_run()中。

（14）对于运行在被动活动主体中的任务其主要的循环已经进入了。任务将会进入os_ReceiveFromQueue()同时被阻塞直到它的消息队列接收到一个消息为止。