NAS層架構03

明朝百曉生發表於2020-12-18

參考文件

NAS 層 華為,中興網上有很多文件寫的很好。

整個核心技術還是RF射頻,以及L1,L2層演算法。

https://www.txrjy.com/thread-1134676-1-1.html

https://blog.csdn.net/twjy1314/article/details/68065029

https://blog.csdn.net/xiashaohua/article/details/40828969?utm_medium=distribute.pc_relevant_t0.none-task-blog-BlogCommendFromMachineLearnPai2-1.add_param_isCf&depth_1-utm_source=distribute.pc_relevant_t0.none-task-blog-BlogCommendFromMachineLearnPai2-1.add_param_isCf

https://blog.csdn.net/macrohasdefined/article/details/19974069?utm_medium=distribute.pc_relevant.none-task-blog-BlogCommendFromMachineLearnPai2-9.edu_weight&depth_1-utm_source=distribute.pc_relevant.none-task-blog-BlogCommendFromMachineLearnPai2-9.edu_weight
https://blog.csdn.net/zhangchangfeng1/article/details/100011608?utm_medium=distribute.pc_relevant.none-task-blog-title-11&spm=1001.2101.3001.4242
https://blog.csdn.net/perimeter/article/details/44836199?utm_medium=distribute.pc_relevant.none-task-blog-title-14&spm=1001.2101.3001.4242
https://blog.csdn.net/u011212816/article/details/81901356?utm_medium=distribute.pc_relevant.none-task-blog-BlogCommendFromMachineLearnPai2-7.edu_weight&depth_1-utm_source=distribute.pc_relevant.none-task-blog-BlogCommendFromMachineLearnPai2-7.edu_weight
https://blog.csdn.net/zhangchangfeng1/article/details/100011136?utm_medium=distribute.pc_relevant.none-task-blog-title-7&spm=1001.2101.3001.4242
https://blog.csdn.net/qq_27540925/article/details/79459111?utm_medium=distribute.pc_relevant.none-task-blog-BlogCommendFromMachineLearnPai2-1.edu_weight&depth_1-utm_source=distribute.pc_relevant.none-task-blog-BlogCommendFromMachineLearnPai2-1.edu_weight
https://download.csdn.net/download/qq_27540925/10271778
https://blog.csdn.net/qq_27540925/article/details/79467754
https://blog.csdn.net/u011263761/article/details/79896301?utm_medium=distribute.pc_relevant_t0.none-task-blog-BlogCommendFromMachineLearnPai2-1.edu_weight&depth_1-utm_source=distribute.pc_relevant_t0.none-task-blog-BlogCommendFromMachineLearnPai2-1.edu_weight
https://blog.csdn.net/keyanting_2018/article/details/88423362?utm_medium=distribute.pc_relevant.none-task-blog-title-2&spm=1001.2101.3001.4242
https://blog.csdn.net/qq_43631743/article/details/106420674?utm_medium=distribute.pc_relevant_download.none-task-blog-baidujs-8.nonecase&depth_1-utm_source=distribute.pc_relevant_download.none-task-blog-baidujs-8.nonecase
https://zhuanlan.zhihu.com/p/62245921
https://www.cnblogs.com/zxc2man/p/7778058.html
http://sigquit.wordpress.com/2012/08/20/an-introduction-to-libqmi/ http://www.lanedo.com/users/amorgado/talks/FOSDEM2013%20-%20Mobile%20broadband%20modem%20control%20protocols.pdf http://blogs.gnome.org/dcbw/2010/04/15/mobile-broadband-and-qualcomm-proprietary-protocols/
https://blog.csdn.net/zhangpengzhen1990/article/details/107432403
https://www.csdn.net/gather_22/MtTagg1sNTIzMDgtYmxvZwO0O0OO0O0O.html
https://wenku.baidu.com/view/86911e291cb91a37f111f18583d049649a660e49.html
https://wenku.baidu.com/view/a54c242e6edb6f1aff001fbf.html
https://max.book118.com/html/2019/0603/8057002073002026.shtm
http://www.mamicode.com/info-detail-478669.html
https://wenku.baidu.com/view/678adb3e05a1b0717fd5360cba1aa81145318f76.html
https://blog.csdn.net/perimeter/article/details/44836199?locationNum=3
https://wenku.baidu.com/view/ab36e7788c9951e79b89680203d8ce2f00666505.html

https://blog.csdn.net/u011212816/article/details/97394498
https://www.csdn.net/gather_21/MtjaIg4sNTgwMTEtYmxvZwO0O0OO0O0O.html
https://blog.csdn.net/u011212816/article/details/81069710
https://blog.csdn.net/qq_36562473/article/details/78535222?utm_medium=distribute.pc_aggpage_search_result.none-task-blog-2~all~first_rank_v2~rank_v25-5-78535222.nonecase&utm_term=nas%E5%B1%82%20qxdm&spm=1000.2123.3001.4430
https://blog.csdn.net/u011263761/article/details/79896301?utm_medium=distribute.pc_aggpage_search_result.none-task-blog-2~all~first_rank_v2~rank_v25-8-79896301.nonecase&utm_term=nas%E5%B1%82%20qxdm&spm=1000.2123.3001.4430
https://blog.csdn.net/zhangchangfeng1/article/details/100011136?utm_medium=distribute.pc_aggpage_search_result.none-task-blog-2~all~first_rank_v2~rank_v25-9-100011136.nonecase&utm_term=nas%E5%B1%82%20qxdm&spm=1000.2123.3001.4430
https://blog.csdn.net/keyanting_2018/article/details/88407069?utm_medium=distribute.pc_relevant_t0.none-task-blog-BlogCommendFromMachineLearnPai2-1.edu_weight&depth_1-utm_source=distribute.pc_relevant_t0.none-task-blog-BlogCommendFromMachineLearnPai2-1.edu_weight
https://blog.csdn.net/qq_30943197/article/details/81434284?utm_medium=distribute.pc_relevant.none-task-blog-utm_term-10&spm=1001.2101.3001.4242
https://zhuanlan.zhihu.com/p/62245921
http://bbs.16rd.com/thread-17115-1-1.html
https://www.baidu.com/link?url=X5uVJJTgutaV7QkvduU_mkKs5HnVp62Z2YZPJuz9MVQCisrWLnUFAMaIAGdi2ApNfQ56HQYuIPh-d-s-ODsNo_&wd=&eqid=cc03e06e000342aa000000025f8f969f
https://blog.csdn.net/zhangbijun1230/article/details/79951752

目錄

  1.    MM/GMM 模組
  2.    UMTS 開機流程
  3.    Cell Selection S準則
  4.    從切比雪夫不等式看駐網時間

 


一  MM(Mobility Management)|GMM(GPRS Mobility Management)

     1.1 架構

       

     1.2 MM 模組主要作用

            TMSI 重配 |Authentication|Identification|IMSI detach|Abort| MM 訊息|Location update

     1.3 GMM模組主要作用

             GPRS attach|Routing area update|GPRS detach|Service requestGMM information|Authentication and ciphering|Identification|P-TMSI reallocation

 

    這裡結合UMTS 開機註冊網路講解一下主要涉及點

   


二 UMTS 開機註冊流程

    AP 部分網上例子很多,之前也有講過,這裡重點結合MM|REG|GMM模組介紹一下Modem 對應的流程

     2.1 AP 部分

       

     

  2.2: Modem 部分

  2.3 Modem 註冊上網流程圖

        主要是WCDMA,LTE, GSM ,5G 也差不多,有些細節不一樣。這個網上有華為寫過相關總結,

可以參考一下,差不多。

        

   2.4 相關日誌

    

*******step1 對應APRADIO_POWER*************

03:00:43.685359	[0x1544]	QMI_MCS_QCSI_PKT
MsgType = Request
operating_mode = DMS_OP_MODE_ONLINE

03:00:44.149295	[0x1544]	QMI_MCS_QCSI_PKT
MsgType = Response
result = QMI_RESULT_SUCCESS
operating_mode = DMS_OP_MODE_ONLINE



*********step2  NAS讀取SIM卡資訊************
  RPLMN: 開機過程中,優先順序別最高
  FPLMN : 當搜到該小區的時候,不去註冊
03:00:42.660001          NAS REG/High             [           reg_sim.c   8965] DS: SUB 1 =REG= EHPLMN list (length = 3)                         
03:00:42.660001          NAS REG/High             [           reg_sim.c   8966] DS: SUB 1 =REG=  # MCC-MNC                        
03:00:42.660001          NAS REG/High             [           reg_sim.c   8987] DS: SUB 1 =REG=  0 460- 01                         
03:00:42.660001          NAS REG/High             [           reg_sim.c   8987] DS: SUB 1 =REG=  1 460- 06                         
03:00:42.660001          NAS REG/High             [           reg_sim.c   8983] DS: SUB 1 =REG=  2 004-555                        
03:00:42.660001          NAS REG/High             [           reg_sim.c   2659] DS: SUB 1 =REG= SIM card mode (USIM)                                                                            03:00:42.660001          NAS REG/High             [           reg_sim.c   3123] DS: SUB 1 =REG= IMSI[0] = 0x49 IMSI[1] = 0x09 IMSI[2] = 0x13                                       03:00:42.660001          NAS REG/High             [           reg_sim.c   3912] DS: SUB 1 =REG= PS RPLMN(460-1)                                                                                    03:00:42.660001          NAS REG/High             [           reg_sim.c   3927] DS: SUB 1 =REG= CS RPLMN(460-1)   


***********step3 NAS→RRC  發起RRC 連線**************
可以看到使用者選擇的網路模式,在android telphony 部分設定傳下來。
03:00:43.688011          NAS REG/High             [          reg_send.c   1914] DS: SUB 1 =REG= MMR_REG_REQ PLMN(460-1) RAT(0-GSM,1-W,2-LTE,3-TDS) = 1 netsel 0, type 1 grat_scan_done 0 
03:00:43.688011          NAS MM/High              [           mmcoord.c   3036] DS: SUB 1 =MM= MM received MMR_REG_REQ [64 f0 10]                         
03:00:43.688011          NAS MM/High              [         mmrrcconn.c    870] DS: SUB 1 =MM= MM sent RRC_SERVICE_REQ to RRC service request cause 0 scan scope 0                        
03:00:43.688011          WCDMA RRC/High           [     rrcdispatcher.c   5214] Recd: RRC_SERVICE_REQ1                       
03:00:43.695990          WCDMA RRC/High           [     rrcdispatcher.c   4685] Recd RRC_CPHY_START_WCDMA_MODE_CNF1     


*************step4 RF Tune ************

 這個很重要,不同產品的RF器件不一樣,直接影響到駐網時間。主要作用是掃描頻點:
預設是System Scan:


Band Scan 有兩種模式
1: System Scan: 從預設的資料庫裡面,搜尋上次駐留網路的Band
2:    Full Band Scan: 全頻段掃描,掃描週期比較慢。30s左右,跟Band ,RAT 有關係 

OOS 演算法又不一樣
   搜網間隔是   x1(times) |x2(times)| x3(times): 週期搜網,中間有個間隔gap,



03:00:43.695990          WCDMA RRC/High           [        rrccsputil.c  12770] Current scan is set to RRC_CSP_CELL_SELECTION_SCAN1      
03:00:43.695990          WCDMA L1/High            [      wl1dlcarrcfg.c   5372] L1M RF tuned to 10663, chain 0.1     



03:00:43.695990	[0x4800]	WCDMA RRC Search Request Information 
Request Type         = RRC_SERVICE_REQ
Network Select Mode  = Automatic
Requested Plmn
   MCC                  = 460
   MNC                  = 01F
Band Preference      = 0x0002000000400000
03:00:43.695990          WCDMA L1/Error           [          l1msetup.c   7786] L1 state now FS1 
03:00:43.695990	[0x4802]	WCDMA RRC ACQ DB Information  ,從之前駐留的頻點裡面先搜
Num Acq DB Entry     = 1
ACQ DB Entries
   -------------------------------------------------------
   |   |Plmn   |          |          |          |        |
   |#  |MCC|MNC|UARFCN    |Cell Id   |CSG ID    |PSC     |
   -------------------------------------------------------
   |  0|460|01F|     10663| 100834611|4294967295|     603|
                   

03:00:43.699740	[0x41B0]	WCDMA Freq Scan  #搜尋結果
Version          = 1
Freq Scan Type   = List scan (3)
Freq Scan Thresh = -482
Number of ARFCN  = 1
-----------------------
|   |     |RSSI |RSSI |
|#  |ARFCN|(raw)|(dBm)|
-----------------------
|  0|10663|     |  -72|

                                                                                  
                 

**********step5   時隙同步 ACQ, 選擇訊號質量最好的頻點****************
In this case, ACQ DB search yields good RSSI on channel 10663
                 
03:00:43.703125          WCDMA L1/Error           [          l1msetup.c   7802] L1 state now ACQ                   
03:00:43.703125          WCDMA L1/Fatal           [           srchacq.c   3701] ACQ REQ:Rx AGC -72 Chan 10663 band 10241                      
03:00:43.775000          WCDMA L1/High            [       srchacqproc.c    634] Step 0 succeeded. Next step: 5, proc: 0, bmsk: 0xe01                     
03:00:43.857680          WCDMA L1/High            [       srchacqproc.c    893] ACQ SUCCESS! FREQ:10663 PSC:503 STTD:0 PROC:01     

******** step6  Set up BCH-PCCPCH to read SIBs   ***************
    主要讀取Selection 引數,以及 小區能力
SIB2,SIB3,SIB11,

03:00:43.857680          WCDMA RRC/High           [        rrcsibproc.c  13243] RRC_GET_SPECIFIC_SIBS_REQ cmd received contents:for_serving_cell 1,scan type 0, LLC SBCCH setup status 0, serving cell    
03:00:44.291171          WCDMA RRC/High           [        rrcsibproc.c  11923] Sending GET_SPECIFIC_SIBS_CNF cmd1  

參考文件: http://blog.sina.com.cn/s/blog_515f51f90100lovn.html
這裡主要讀取SIB1,SIB3. 
其中最重要的是SIB3, 包含如下資訊:
.Cell Selection and Re-selection info(小區選擇和重選資訊;)
⑴Mapping info:這一引數在系統間小區選擇是使用.

⑵Cell Selection and Re-selection_quanlity measure:指示選擇使用CPICH Ec/No還是使用CPICH RSCP作為質量測量的引數.
FDD模式的小區選擇引數有: \ \ \RAT List \Qqualmin \ Qrxlevmin 等
小區選擇/重選的其他引數有: \ \ \HCS Serving cell Information &Maximum Allowed UL TX Power
cell Access Restriction小區接入限制資訊.指示小區是否被禁止,是否被運營商預留使用.


三  小區駐網 Cell Selection 

          參考文件:  https://www.docin.com/p-302506100.html

         經常遇到tester 問的問題,為神馬我手機手動選網能註冊到LTE網路上面,開機直接駐留網路就會到GSM上面。這個跟S準則,以及R準則有關係。

          SIB2: PLMN  資訊,跟SIM卡中的FPLMN等資訊做對比

          SIB3: 小區Selection ,Reselction 準則,用於判斷是否可以接入,重新

          SIB11:  鄰小區資訊,重選用

          CPICH是Common Pilot Channel的縮寫,意為公共導頻通道

 

          手機開機 首先搜尋之前 小區|頻點,找到訊號最好的,然後時隙同步(acq),最後讀取SIB訊息,根據當前的訊號質量判斷是否符合S準則以及小區非Barred(SIB訊息裡面),符合則發起Camp。

          GSM: 主要S_{rxlev}>0

          UMTS:

              要滿足兩個條件: 

                           S_{rxlev}>0; S_{qual}>0

                           Squal= ecio-Qqualmin

                           Srxlev = RSCP-Qrxlevmin-max{UE_TXPWR_MAX_RACH-P_MAX,0}

              說明:

                           Squal:小區選擇的訊號質量值(RSRQ值)

                            ecio: 導頻強度; 訊雜比,手機測量出來的。

                            Qqualmin: 網路配置,SIB3 訊息裡面

                           Srxlev:小區選擇的接收電平值

                           RSCP: 

                           Qrxlevmin:小區要求的最小接收電平值(sib3)

                           UE_TXPWR_MAX_RACH:  網路最大允許的  上行 發射功率,SIB3中配置。該引數設定的越大,UE選擇該小區駐留越困難;設定越小,則越容易,但是有可能造成UE駐留該小區之後,不能正確接收PCCPCH承載的系統訊息

                           P_MAX: 手機最大的發射功率。 https://wenku.baidu.com/view/dfdde6146c175f0e7cd13750.html

                           

                             

                           


*************step 7 RRC checks that the NAS supplied MCC-MNC matches with that received on BCH of newly acquired cell****************
                
03:00:43.931170          WCDMA RRC/High           [        rrccsputil.c  20995] frequency 10663 band 1024 added to available PLMN list1                       
03:00:44.291171          WCDMA RRC/High           [          rrccspdb.c   1651] Updated: PLMN 460-1 freq 10663 scr_code 8048 band 1024 CSG ID -1; num_csg_entries:0, curr_wr_index:1 in Acq DB1        03:00:44.291146          WCDMA RRC/High           [          rrccspdb.c   1843] CSG: Added: PLMN 460-1, CSG ID -1; num_csg_entries: 0, curr_wr_index: 12     
                



*************step8  評估S準則 (S criteria) ************

注: 小區重新是R準則(Ranking演算法) 該過程用不到 rrcdata|rrccsputil

03:00:44.291171          WCDMA L1/High            [            l1mcmd.c   1676] Received CELL_SELECTION_REQ1                        
03:00:44.291171          WCDMA RRC/High           [            rrccsp.c   5731] Qualmin -18, Rxlevmin -115, MaxULTxPower 24                     
03:00:44.293723          WCDMA L1/High            [             wsrch.c  28228] Qqualmin -18 Qrxlevmin -115 2*ecio=-5   2*squal=31 srxlv=40 rscp=-74    
03:00:44.293723          WCDMA RRC/High           [            rrccsp.c  14271] S criteria is met. curr_scan 0, splmn 1, g_srch_done 0,bcch_nas_match = 1, nas_eplmn = 0, bcch_eplmn = 01  
03:00:44.293723          WCDMA L1/High            [             wsrch.c  28265] Cell Selection Succeed, List srch cnt:11            

說明:
2*Squal = 2*ecio-2*Qqualmin= -5+2*18= 31>0
Srxlev = RSCP-Qrxlevmin-max{UE_TXPWR_MAX_RACH-P_MAX,0}
            =-74+115-max(24-23,0)
            =40

Qrxlevmin and UE_TXPWR_MAX_RACH is from SIB3
Qqualmin is from SIB3
https://www.docin.com/p-302506100.html
P_MAX: UE 最大發射功率


後續駐網後,在測量報告中也可以持續看到該值
【0x412F】UL_DCCH Measurement Report
Channel Type = UL_DCCH, Radio Bearer ID = 2, Uarfcn = N/A, Psc = N/A, Message Length = 22
  message measurementReport : 
    {
      measurementIdentity 5,
      measuredResults intraFreqMeasuredResultsList : 
        {
          {
            modeSpecificInfo fdd : 
              {
                primaryCPICH-Info 
                {
                  primaryScramblingCode 42
                },
                cpich-Ec-N0 0,
                cpich-RSCP 1
              }
          },

*****************step9 NAS Initiates “Registration*****************************
03:00:44.308020          NAS MM/High              [            mmsend.c   1480] DS: SUB 1 =MM= MM sent MMR_CAMPED_IND  RAT : 1, BAND : 4194304                       
03:00:44.309009          NAS MM/High              [            gmmmsg.c   3388] DS: SUB 1 =MM= Sending ATTACH REQUEST message                         
03:00:44.309009          NAS MM/High              [            mmsend.c   3609] DS: SUB 1 =MM= MM sent MMR_CELL_SERVICE_IND: hsdpa_supp=3, dtm_supp=0, egprs_supp=0          


****************step10 OTA 互動*****************************
03:00:44.362030	[0x412F]	UL_CCCH RRC Connection Request  We send this message on the RACH
Channel Type = UL_CCCH, Radio Bearer ID = 0, Uarfcn = 10663, Psc = 503, Message Length = 15

      plmn-Identity :mcc 460 mnc 01
      establishmentCause registration,

03:00:44.370155          WCDMA L1/High            [              wenc.c   7687] PrCPICH_P 33, CPICH_RSCP -75, UL_IF -105 const_val -20, Preambl_P -17, TFCI 01    
Primary CPICH TX power (SIB 5)   
CPICH_RSCP (UE measurement)
UL interference (SIB 7)
Constant Value (SIB 5)         
Preamble_Initial_Power= 33-(-75)+(-105)+(-20) = -17   
                                                                              
03:00:44.415546          WCDMA L1/Fatal           [              wenc.c  11096] UL_RACH: RACH Tx successful, TxAgc -13, ai_Sum 6e66 Free Add:01                  
03:00:44.415546          WCDMA L2/High            [           macrach.c   1061] rcvd L1_PRACH_ACK from L11   

************step11  NAS REG 更新註冊狀態**************
          
2020 Sep  2  03:00:44.306  [D7]  0x4127  WCDMA Cell ID
UTRA UL Absolute RF channel number     = 9713
UTRA DL Absolute RF channel number     = 10663
Cell identity (28-bits)                = 100834611
URA to use in case of overlapping URAs = 1
Cell Access Restrictions:
	Cell Barred                    = FALSE
	Cell Reservered                = FALSE
	Cell Reserved for SolSA        = FALSE
	UE Camped on Cell              = TRUE
Allowed Call Access                    = All Calls
PSC (Primary Scrambling Code)          = 8048
PLMN                                   = 460 - 01F
LAC id                                 = 53506
RAC id                                 = 1      
03:00:45.868987          NAS REG/High             [         reg_state.c  11165] DS: SUB 1 =REG= CS_PS_SERVICE on HPLMN(460-1)      


***********step12 通知AP*************************

03:00:45.870003	[0x1544]	QMI_MCS_QCSI_PKT
packetVersion = 2
MsgType = Indication

Service_NAS {
 
         nas_sys_info_indTlvs[3] {
            Type = 0x18
            Length = 33
            wcdma_sys_info {
               common_sys_info {
                  srv_domain_valid = true
                  srv_domain = SYS_SRV_DOMAIN_CS_PS
                  srv_capability_valid = true
                  srv_capability = SYS_SRV_DOMAIN_CS_PS
                  roam_status_valid = true
                  roam_status = NAS_SYS_ROAM_STATUS_OFF
                  is_sys_forbidden_valid = true
                  is_sys_forbidden = false
               }
               threegpp_specific_sys_info {
                  lac_valid = true
                  lac = 53506
                  cell_id_valid = true
                  cell_id = 100834611
                  reg_reject_info_valid = false
                  reg_reject_info {
                     reject_srv_domain = SYS_SRV_DOMAIN_NO_SRV
                     rej_cause = 0
                  }
                  network_id_valid = true
                  network_id {
                     mcc = { 4, 6, 0 }
                     mnc = { 0, 1, (invalid) }
                  }
               }
               wcdma_specific_sys_info {
                  hs_call_status_valid = true
                  hs_call_status = SYS_HS_IND_HSDPA_HSUPA_UNSUPP_CELL
                  hs_ind_valid = true
                  hs_ind = SYS_HS_IND_HSDPA_HSUPA_SUPP_CELL
                  psc_valid = true
                  psc = 503
               }
            }
         }
       

 

   


四       從切比雪夫不等式看駐網時間                

          切比雪夫 證明比較簡單,主要是可以看出當前測量值,和期望值之間誤差上限概率。

         P\bigl(\begin{smallmatrix} |X-u| \geq \leq \varepsilon \end{smallmatrix}\bigr) \leq \frac{\phi ^2}{\varepsilon^2}

            這個如何應用:

            影響駐網: UE由於受到CPU,RF,網路互動,記憶體等因素影響(可以算相關係數)

            每次駐留網路都偏差很大。

           \varepsilon : 作為與期望駐網時間的誤差t

           \phi:   實際測試出來的駐網時間方差

           根據實際頻率,算出數學期望,可以動態的調整該\varepsilon值。

                 

            

 

       

     

    

相關文章