diff --git a/mbtk/mbtk_rild_v2/src/main.c b/mbtk/mbtk_rild_v2/src/main.c
index ce74dd9..bea62bb 100755
--- a/mbtk/mbtk_rild_v2/src/main.c
+++ b/mbtk/mbtk_rild_v2/src/main.c
@@ -1146,6 +1146,12 @@
        1, 10, 0, 1, 0, 9, 128, 5, 2358781729,
        79, 788390, 733390
     */
+
+    if(cell_info.cell_list.num>=6 || cell_info.cell_list.num>=CELL_NUM_MAX)
+    {
+        LOGW("cell num reach uplimit %d",cell_info.cell_list.num);
+        return;
+    }
     if(strStartsWith(s, "+EEMNRSVC:")) {
         // mcc,lenOfMnc,mnc,tac,PCI,dlNrArfcn,ulNrArfcn,band,rsrp,rsrq,sinr,rssi
         // cellID
@@ -1650,6 +1656,13 @@
                 goto EEMUMTSSVC_EXIT;
             }
             cell_info.cell_list.cell[cell_info.cell_list.num].value4= (uint32)tmp_int;
+
+            // length of mnc
+            if (at_tok_nextint(&line, &tmp_int) < 0)
+            {
+                goto EEMUMTSSVC_EXIT;
+            }
+    
             // mnc
             if (at_tok_nextint(&line, &tmp_int) < 0)
             {
@@ -1669,11 +1682,11 @@
             }
             cell_info.cell_list.cell[cell_info.cell_list.num].value2 = (uint32)tmp_int;
 
-            if (at_tok_nextint(&line, &tmp_int) < 0)
+            if (at_tok_nextint(&line, &tmp_int) < 0)  //ura
             {
                 goto EEMUMTSSVC_EXIT;
             }
-            // cpi
+            // psc
             if (at_tok_nextint(&line, &tmp_int) < 0)
             {
                 goto EEMUMTSSVC_EXIT;
@@ -2848,7 +2861,7 @@
 
                                 // Send msg RIL_MSG_ID_IND_SER_STATE_CHANGE to client.
                                 mbtk_ril_ser_state_enum state = MBTK_RIL_SER_STATE_READY;
-                                ril_ind_pack_send(MBTK_SIM_1, client_fd, RIL_MSG_ID_IND_SER_STATE_CHANGE, &state, 1);
+                                ril_ind_pack_send(MBTK_SIM_1, client_fd, RIL_MSG_ID_IND_SER_STATE_CHANGE, &state, sizeof(state));
                             }
                             else
                             {
diff --git a/mbtk/mbtk_rild_v2/src/ril_net.c b/mbtk/mbtk_rild_v2/src/ril_net.c
index 258ea66..dfeda42 100755
--- a/mbtk/mbtk_rild_v2/src/ril_net.c
+++ b/mbtk/mbtk_rild_v2/src/ril_net.c
@@ -781,6 +781,33 @@
     return err;
 }
 
+#if 0
+typedef enum
+{
+    MBTK_NET_REG_STATE_NON  = 0,
+    MBTK_NET_REG_STATE_HOME,
+    MBTK_NET_REG_STATE_SEARCHING,
+    MBTK_NET_REG_STATE_DENIED,
+    MBTK_NET_REG_STATE_UNKNOWN,
+    MBTK_NET_REG_STATE_ROAMING,
+    MBTK_NET_REG_STATE_SMS_ONLY,
+    MBTK_NET_REG_STATE_ROAMING_SMS,
+    MBTK_NET_REG_STATE_ATTACHED_EMERGENCY,
+    MBTK_NET_REG_STATE_CSFB_HOME,
+    MBTK_NET_MBTK_NET_REG_STATE_NONREG_STATE_CSFB_ROAMING,
+    MBTK_NET_REG_STATE_EMERGENCY_ONLY
+} mbtk_net_reg_state_enum;
+
+#endif
+bool is_net_registered(int reg_state)
+{   
+    if(reg_state==MBTK_NET_REG_STATE_NON || (reg_state>=MBTK_NET_REG_STATE_SEARCHING && reg_state<=MBTK_NET_REG_STATE_UNKNOWN ))
+    {
+        return false;
+    }
+    return true;
+}
+
 /*
 AT+CREG=3
 OK
@@ -816,6 +843,7 @@
 static int req_net_reg_get(mbtk_sim_type_enum sim_id, ATPortType_enum port, mbtk_net_reg_info_t *reg, int *cme_err)
 {
     ATResponse *response = NULL;
+    char *line;
     int tmp_int;
     char *tmp_str = NULL;
     int err = at_send_command(portType_2_portId(sim_id, port), "AT+CREG=3", &response);
@@ -826,56 +854,7 @@
         goto exit;
     }
     at_response_free(response);
-
-    err = at_send_command_multiline(portType_2_portId(sim_id, port), "AT+CREG?", "+CREG:", &response);
-    if (err < 0 || response->success == 0 || !response->p_intermediates){
-        if(cme_err) {
-            *cme_err = at_get_cme_error(response);
-        }
-        goto exit;
-    }
-
-    char *line = response->p_intermediates->line;
-    err = at_tok_start(&line);
-    if (err < 0)
-    {
-        goto exit;
-    }
-    err = at_tok_nextint(&line, &tmp_int); // n
-    if (err < 0)
-    {
-        goto exit;
-    }
-    err = at_tok_nextint(&line, &tmp_int);// stat
-    if (err < 0)
-    {
-        goto exit;
-    }
-    reg->call_state = (uint8)tmp_int;
-
-    if(at_tok_hasmore(&line)) {
-        err = at_tok_nextstr(&line, &tmp_str); // lac
-        if (err < 0)
-        {
-            goto exit;
-        }
-        reg->lac = strtol(tmp_str, NULL, 16);
-
-        err = at_tok_nextstr(&line, &tmp_str); // ci
-        if (err < 0)
-        {
-            goto exit;
-        }
-        reg->ci = strtol(tmp_str, NULL, 16);
-
-        err = at_tok_nextint(&line, &tmp_int);// AcT
-        if (err < 0)
-        {
-            goto exit;
-        }
-        reg->type = (uint8)tmp_int;
-    }
-    at_response_free(response);
+    response=NULL;
 
     err = at_send_command_multiline(portType_2_portId(sim_id, port), "AT+CEREG?", "+CEREG:", &response);
     if (err < 0 || response->success == 0 || !response->p_intermediates){
@@ -903,7 +882,7 @@
     }
     reg->data_state = (uint8)tmp_int;
 
-    if(reg->lac == 0 && at_tok_hasmore(&line)) {
+    if(at_tok_hasmore(&line)) {
         err = at_tok_nextstr(&line, &tmp_str); // lac
         if (err < 0)
         {
@@ -924,9 +903,45 @@
             goto exit;
         }
         reg->type = (uint8)tmp_int;
-    } else if(reg->data_state == 0 && (band_info.net_support & MBTK_NET_SUPPORT_5G)) {
+    }
+    at_response_free(response); 
+    response=NULL;
+
+    if(is_net_registered(reg->data_state))
+    {
+        err = at_send_command_multiline(portType_2_portId(sim_id, port), "AT+CIREG?", "+CIREG:", &response);
+        if (err < 0 || response->success == 0 || !response->p_intermediates){
+            reg->ims_state = (uint8)0;
+            err = 0;
+            goto exit;
+        }
+        line = response->p_intermediates->line;
+        err = at_tok_start(&line);
+        if (err < 0)
+        {
+            goto exit;
+        }
+        err = at_tok_nextint(&line, &tmp_int); // n/stat
+        if (err < 0)
+        {
+            goto exit;
+        }
+        if(at_tok_hasmore(&line)) {
+            err = at_tok_nextint(&line, &tmp_int);// stat
+            if (err < 0)
+            {
+                goto exit;
+            }
+            reg->ims_state = (uint8)tmp_int;
+        } else {
+            reg->ims_state = (uint8)tmp_int;
+        }
+        reg->call_state=reg->ims_state;
         at_response_free(response);
-        err = at_send_command_multiline(portType_2_portId(sim_id, port), "AT+C5GREG?", "+C5GREG:", &response);
+        response=NULL;
+    }
+    else{
+        err = at_send_command_multiline(portType_2_portId(sim_id, port), "AT+CREG?", "+CREG:", &response);
         if (err < 0 || response->success == 0 || !response->p_intermediates){
             if(cme_err) {
                 *cme_err = at_get_cme_error(response);
@@ -950,9 +965,9 @@
         {
             goto exit;
         }
-        reg->data_state = (uint8)tmp_int;
+        reg->call_state = (uint8)tmp_int;
 
-        if(/*reg->lac == 0 && */at_tok_hasmore(&line)) {
+        if(at_tok_hasmore(&line)) {
             err = at_tok_nextstr(&line, &tmp_str); // lac
             if (err < 0)
             {
@@ -974,36 +989,10 @@
             }
             reg->type = (uint8)tmp_int;
         }
+        at_response_free(response);
+        response=NULL;
     }
-    at_response_free(response);
 
-    err = at_send_command_multiline(portType_2_portId(sim_id, port), "AT+CIREG?", "+CIREG:", &response);
-    if (err < 0 || response->success == 0 || !response->p_intermediates){
-        reg->ims_state = (uint8)0;
-        err = 0;
-        goto exit;
-    }
-    line = response->p_intermediates->line;
-    err = at_tok_start(&line);
-    if (err < 0)
-    {
-        goto exit;
-    }
-    err = at_tok_nextint(&line, &tmp_int); // n/stat
-    if (err < 0)
-    {
-        goto exit;
-    }
-    if(at_tok_hasmore(&line)) {
-        err = at_tok_nextint(&line, &tmp_int);// stat
-        if (err < 0)
-        {
-            goto exit;
-        }
-        reg->ims_state = (uint8)tmp_int;
-    } else {
-        reg->ims_state = (uint8)tmp_int;
-    }
 
 exit:
     at_response_free(response);
@@ -1321,25 +1310,25 @@
 {
     ATResponse *response = NULL;
     char cmd[500] = {0};
-	char data[218] = {0};
+    char data[218] = {0};
     int err = 0;
 
-	memcpy(data, cmgl, len);
+    memcpy(data, cmgl, len);
 
-	sprintf(cmd, "AT*CELL=%s", data);
+    sprintf(cmd, "AT*CELL=%s", data);
 
-	if(strlen(cmd) > 0)
-	{
+    if(strlen(cmd) > 0)
+    {
         err = at_send_command_multiline(portType_2_portId(sim_id, port), cmd, "", &response);
-		if (err < 0 || response->success == 0 || !response->p_intermediates){
-			*cme_err = at_get_cme_error(response);
-			goto exit;
-		}
+        if (err < 0 || response->success == 0 || !response->p_intermediates){
+            *cme_err = at_get_cme_error(response);
+            goto exit;
+        }
 
         ATLine* lines_ptr = response->p_intermediates;
         char *line = NULL;
 //        int reg_len = 0;
-//		bool flag = false;
+//        bool flag = false;
         while(lines_ptr)
         {
             line = lines_ptr->line;
@@ -1349,9 +1338,9 @@
             }
             lines_ptr = lines_ptr->p_next;
         }
-	}
+    }
     err = 0;
-	memcpy(reg, "req_cell_info_set succss", strlen("req_cell_info_set succss"));
+    memcpy(reg, "req_cell_info_set succss", strlen("req_cell_info_set succss"));
 exit:
     at_response_free(response);
     return err;
@@ -1689,8 +1678,9 @@
                 else
                 {
                     LOG("req_cell_info_get() success,cell number: %d", cell_info.cell_list.num);
-                    LOGD("data_len = %d", sizeof(mbtk_cell_info_array_t));
-                    ril_rsp_pack_send(cli_info->sim_id, cli_info->port, cli_info->fd, pack->msg_id, pack->msg_index, &cell_info.cell_list, sizeof(mbtk_cell_info_array_t));
+                    int msg_len=sizeof(mbtk_cell_info_array_t)-(CELL_NUM_MAX-cell_info.cell_list.num)*sizeof(mbtk_cell_info_t);
+                    LOGD("data_len = %d", msg_len);
+                    ril_rsp_pack_send(cli_info->sim_id, cli_info->port, cli_info->fd, pack->msg_id, pack->msg_index, &cell_info.cell_list,msg_len);
                 }
             }
             else     // Lock cell