NAS層架構03
參考文件
NAS 層 華為，中興網上有很多文件寫的很好。
整個核心技術還是RF射頻，以及L1,L2層演算法。
https://www.txrjy.com/thread-1134676-1-1.html
https://blog.csdn.net/twjy1314/article/details/68065029
https://blog.csdn.net/macrohasdefined/article/details/19974069?utm_medium=distribute.pc_relevant.none-task-blog-BlogCommendFromMachineLearnPai2-9.edu_weight&depth_1-utm_source=distribute.pc_relevant.none-task-blog-BlogCommendFromMachineLearnPai2-9.edu_weight
https://blog.csdn.net/zhangchangfeng1/article/details/100011608?utm_medium=distribute.pc_relevant.none-task-blog-title-11&spm=1001.2101.3001.4242
https://blog.csdn.net/perimeter/article/details/44836199?utm_medium=distribute.pc_relevant.none-task-blog-title-14&spm=1001.2101.3001.4242
https://blog.csdn.net/u011212816/article/details/81901356?utm_medium=distribute.pc_relevant.none-task-blog-BlogCommendFromMachineLearnPai2-7.edu_weight&depth_1-utm_source=distribute.pc_relevant.none-task-blog-BlogCommendFromMachineLearnPai2-7.edu_weight
https://blog.csdn.net/zhangchangfeng1/article/details/100011136?utm_medium=distribute.pc_relevant.none-task-blog-title-7&spm=1001.2101.3001.4242
https://blog.csdn.net/qq_27540925/article/details/79459111?utm_medium=distribute.pc_relevant.none-task-blog-BlogCommendFromMachineLearnPai2-1.edu_weight&depth_1-utm_source=distribute.pc_relevant.none-task-blog-BlogCommendFromMachineLearnPai2-1.edu_weight
https://download.csdn.net/download/qq_27540925/10271778
https://blog.csdn.net/qq_27540925/article/details/79467754
https://blog.csdn.net/u011263761/article/details/79896301?utm_medium=distribute.pc_relevant_t0.none-task-blog-BlogCommendFromMachineLearnPai2-1.edu_weight&depth_1-utm_source=distribute.pc_relevant_t0.none-task-blog-BlogCommendFromMachineLearnPai2-1.edu_weight
https://blog.csdn.net/keyanting_2018/article/details/88423362?utm_medium=distribute.pc_relevant.none-task-blog-title-2&spm=1001.2101.3001.4242
https://blog.csdn.net/qq_43631743/article/details/106420674?utm_medium=distribute.pc_relevant_download.none-task-blog-baidujs-8.nonecase&depth_1-utm_source=distribute.pc_relevant_download.none-task-blog-baidujs-8.nonecase
https://zhuanlan.zhihu.com/p/62245921
https://www.cnblogs.com/zxc2man/p/7778058.html
http://sigquit.wordpress.com/2012/08/20/an-introduction-to-libqmi/ http://www.lanedo.com/users/amorgado/talks/FOSDEM2013%20-%20Mobile%20broadband%20modem%20control%20protocols.pdf http://blogs.gnome.org/dcbw/2010/04/15/mobile-broadband-and-qualcomm-proprietary-protocols/
https://blog.csdn.net/zhangpengzhen1990/article/details/107432403
https://www.csdn.net/gather_22/MtTagg1sNTIzMDgtYmxvZwO0O0OO0O0O.html
https://wenku.baidu.com/view/86911e291cb91a37f111f18583d049649a660e49.html
https://wenku.baidu.com/view/a54c242e6edb6f1aff001fbf.html
https://max.book118.com/html/2019/0603/8057002073002026.shtm
http://www.mamicode.com/info-detail-478669.html
https://wenku.baidu.com/view/678adb3e05a1b0717fd5360cba1aa81145318f76.html
https://blog.csdn.net/perimeter/article/details/44836199?locationNum=3
https://wenku.baidu.com/view/ab36e7788c9951e79b89680203d8ce2f00666505.html
https://blog.csdn.net/u011212816/article/details/97394498
https://www.csdn.net/gather_21/MtjaIg4sNTgwMTEtYmxvZwO0O0OO0O0O.html
https://blog.csdn.net/u011212816/article/details/81069710
https://blog.csdn.net/qq_36562473/article/details/78535222?utm_medium=distribute.pc_aggpage_search_result.none-task-blog-2~all~first_rank_v2~rank_v25-5-78535222.nonecase&utm_term=nas%E5%B1%82%20qxdm&spm=1000.2123.3001.4430
https://blog.csdn.net/u011263761/article/details/79896301?utm_medium=distribute.pc_aggpage_search_result.none-task-blog-2~all~first_rank_v2~rank_v25-8-79896301.nonecase&utm_term=nas%E5%B1%82%20qxdm&spm=1000.2123.3001.4430
https://blog.csdn.net/zhangchangfeng1/article/details/100011136?utm_medium=distribute.pc_aggpage_search_result.none-task-blog-2~all~first_rank_v2~rank_v25-9-100011136.nonecase&utm_term=nas%E5%B1%82%20qxdm&spm=1000.2123.3001.4430
https://blog.csdn.net/keyanting_2018/article/details/88407069?utm_medium=distribute.pc_relevant_t0.none-task-blog-BlogCommendFromMachineLearnPai2-1.edu_weight&depth_1-utm_source=distribute.pc_relevant_t0.none-task-blog-BlogCommendFromMachineLearnPai2-1.edu_weight
https://blog.csdn.net/qq_30943197/article/details/81434284?utm_medium=distribute.pc_relevant.none-task-blog-utm_term-10&spm=1001.2101.3001.4242
https://zhuanlan.zhihu.com/p/62245921
http://bbs.16rd.com/thread-17115-1-1.html
https://www.baidu.com/link?url=X5uVJJTgutaV7QkvduU_mkKs5HnVp62Z2YZPJuz9MVQCisrWLnUFAMaIAGdi2ApNfQ56HQYuIPh-d-s-ODsNo_&wd=&eqid=cc03e06e000342aa000000025f8f969f
https://blog.csdn.net/zhangbijun1230/article/details/79951752
目錄
- MM/GMM 模組
- UMTS 開機流程
- Cell Selection S準則
- 從切比雪夫不等式看駐網時間
一 MM（Mobility Management）|GMM(GPRS Mobility Management)
1.1 架構
1.2 MM 模組主要作用
TMSI 重配 |Authentication|Identification|IMSI detach|Abort| MM 訊息|Location update
1.3 GMM模組主要作用
GPRS attach|Routing area update|GPRS detach|Service requestGMM information|Authentication and ciphering|Identification|P-TMSI reallocation
這裡結合UMTS 開機註冊網路講解一下主要涉及點
二 UMTS 開機註冊流程
AP 部分網上例子很多，之前也有講過，這裡重點結合MM|REG|GMM模組介紹一下Modem 對應的流程
2.1 AP 部分
2.2： Modem 部分
2.3 Modem 註冊上網流程圖
主要是WCDMA,LTE, GSM ,5G 也差不多，有些細節不一樣。這個網上有華為寫過相關總結，
可以參考一下，差不多。
2.4 相關日誌
*******step1 對應APRADIO_POWER*************
03:00:43.685359 [0x1544] QMI_MCS_QCSI_PKT
MsgType = Request
operating_mode = DMS_OP_MODE_ONLINE
03:00:44.149295 [0x1544] QMI_MCS_QCSI_PKT
MsgType = Response
result = QMI_RESULT_SUCCESS
operating_mode = DMS_OP_MODE_ONLINE
*********step2 NAS讀取SIM卡資訊************
RPLMN： 開機過程中,優先順序別最高
FPLMN ： 當搜到該小區的時候，不去註冊
03:00:42.660001 NAS REG/High [ reg_sim.c 8965] DS: SUB 1 =REG= EHPLMN list (length = 3)
03:00:42.660001 NAS REG/High [ reg_sim.c 8966] DS: SUB 1 =REG= # MCC-MNC
03:00:42.660001 NAS REG/High [ reg_sim.c 8987] DS: SUB 1 =REG= 0 460- 01
03:00:42.660001 NAS REG/High [ reg_sim.c 8987] DS: SUB 1 =REG= 1 460- 06
03:00:42.660001 NAS REG/High [ reg_sim.c 8983] DS: SUB 1 =REG= 2 004-555
03:00:42.660001 NAS REG/High [ reg_sim.c 2659] DS: SUB 1 =REG= SIM card mode (USIM) 03:00:42.660001 NAS REG/High [ reg_sim.c 3123] DS: SUB 1 =REG= IMSI[0] = 0x49 IMSI[1] = 0x09 IMSI[2] = 0x13 03:00:42.660001 NAS REG/High [ reg_sim.c 3912] DS: SUB 1 =REG= PS RPLMN(460-1) 03:00:42.660001 NAS REG/High [ reg_sim.c 3927] DS: SUB 1 =REG= CS RPLMN(460-1)
***********step3 NAS→RRC 發起RRC 連線**************
可以看到使用者選擇的網路模式，在android telphony 部分設定傳下來。
03:00:43.688011 NAS REG/High [ reg_send.c 1914] DS: SUB 1 =REG= MMR_REG_REQ PLMN(460-1) RAT(0-GSM,1-W,2-LTE,3-TDS) = 1 netsel 0, type 1 grat_scan_done 0
03:00:43.688011 NAS MM/High [ mmcoord.c 3036] DS: SUB 1 =MM= MM received MMR_REG_REQ [64 f0 10]
03:00:43.688011 NAS MM/High [ mmrrcconn.c 870] DS: SUB 1 =MM= MM sent RRC_SERVICE_REQ to RRC service request cause 0 scan scope 0
03:00:43.688011 WCDMA RRC/High [ rrcdispatcher.c 5214] Recd: RRC_SERVICE_REQ1
03:00:43.695990 WCDMA RRC/High [ rrcdispatcher.c 4685] Recd RRC_CPHY_START_WCDMA_MODE_CNF1
*************step4 RF Tune ************
這個很重要，不同產品的RF器件不一樣，直接影響到駐網時間。主要作用是掃描頻點：
預設是System Scan:
Band Scan 有兩種模式
1： System Scan: 從預設的資料庫裡面，搜尋上次駐留網路的Band
2: Full Band Scan: 全頻段掃描，掃描週期比較慢。30s左右，跟Band ,RAT 有關係
OOS 演算法又不一樣
搜網間隔是 x1(times) |x2(times)| x3(times): 週期搜網，中間有個間隔gap,
03:00:43.695990 WCDMA RRC/High [ rrccsputil.c 12770] Current scan is set to RRC_CSP_CELL_SELECTION_SCAN1
03:00:43.695990 WCDMA L1/High [ wl1dlcarrcfg.c 5372] L1M RF tuned to 10663, chain 0.1
03:00:43.695990 [0x4800] WCDMA RRC Search Request Information
Request Type = RRC_SERVICE_REQ
Network Select Mode = Automatic
Requested Plmn
MCC = 460
MNC = 01F
Band Preference = 0x0002000000400000
03:00:43.695990 WCDMA L1/Error [ l1msetup.c 7786] L1 state now FS1
03:00:43.695990 [0x4802] WCDMA RRC ACQ DB Information ,從之前駐留的頻點裡面先搜
Num Acq DB Entry = 1
ACQ DB Entries
-------------------------------------------------------
| |Plmn | | | | |
|# |MCC|MNC|UARFCN |Cell Id |CSG ID |PSC |
-------------------------------------------------------
| 0|460|01F| 10663| 100834611|4294967295| 603|
03:00:43.699740 [0x41B0] WCDMA Freq Scan #搜尋結果
Version = 1
Freq Scan Type = List scan (3)
Freq Scan Thresh = -482
Number of ARFCN = 1
-----------------------
| | |RSSI |RSSI |
|# |ARFCN|(raw)|(dBm)|
-----------------------
| 0|10663| | -72|
**********step5 時隙同步 ACQ, 選擇訊號質量最好的頻點****************
In this case, ACQ DB search yields good RSSI on channel 10663
03:00:43.703125 WCDMA L1/Error [ l1msetup.c 7802] L1 state now ACQ
03:00:43.703125 WCDMA L1/Fatal [ srchacq.c 3701] ACQ REQ:Rx AGC -72 Chan 10663 band 10241
03:00:43.775000 WCDMA L1/High [ srchacqproc.c 634] Step 0 succeeded. Next step: 5, proc: 0, bmsk: 0xe01
03:00:43.857680 WCDMA L1/High [ srchacqproc.c 893] ACQ SUCCESS! FREQ:10663 PSC:503 STTD:0 PROC:01
******** step6 Set up BCH-PCCPCH to read SIBs ***************
主要讀取Selection 引數，以及 小區能力
SIB2,SIB3,SIB11,
03:00:43.857680 WCDMA RRC/High [ rrcsibproc.c 13243] RRC_GET_SPECIFIC_SIBS_REQ cmd received contents:for_serving_cell 1,scan type 0, LLC SBCCH setup status 0, serving cell
03:00:44.291171 WCDMA RRC/High [ rrcsibproc.c 11923] Sending GET_SPECIFIC_SIBS_CNF cmd1
參考文件： http://blog.sina.com.cn/s/blog_515f51f90100lovn.html
這裡主要讀取SIB1,SIB3.
其中最重要的是SIB3, 包含如下資訊：
.Cell Selection and Re-selection info(小區選擇和重選資訊;)
⑴Mapping info:這一引數在系統間小區選擇是使用.
⑵Cell Selection and Re-selection_quanlity measure:指示選擇使用CPICH Ec/No還是使用CPICH RSCP作為質量測量的引數.
FDD模式的小區選擇引數有: \ \ \RAT List \Qqualmin \ Qrxlevmin 等
小區選擇/重選的其他引數有: \ \ \HCS Serving cell Information &Maximum Allowed UL TX Power
cell Access Restriction小區接入限制資訊.指示小區是否被禁止,是否被運營商預留使用.
三 小區駐網 Cell Selection
參考文件： https://www.docin.com/p-302506100.html
經常遇到tester 問的問題，為神馬我手機手動選網能註冊到LTE網路上面，開機直接駐留網路就會到GSM上面。這個跟S準則，以及R準則有關係。
SIB2: PLMN 資訊，跟SIM卡中的FPLMN等資訊做對比
SIB3: 小區Selection ,Reselction 準則，用於判斷是否可以接入，重新
SIB11: 鄰小區資訊，重選用
CPICH是Common Pilot Channel的縮寫，意為公共導頻通道
手機開機 首先搜尋之前 小區|頻點，找到訊號最好的，然後時隙同步（acq）,最後讀取SIB訊息，根據當前的訊號質量判斷是否符合S準則以及小區非Barred(SIB訊息裡面），符合則發起Camp。
GSM: 主要
UMTS:
要滿足兩個條件：
Squal= ecio-Qqualmin
Srxlev = RSCP-Qrxlevmin-max{UE_TXPWR_MAX_RACH-P_MAX,0}
說明：
Squal：小區選擇的訊號質量值（RSRQ值）
ecio: 導頻強度; 訊雜比,手機測量出來的。
Qqualmin: 網路配置，SIB3 訊息裡面
Srxlev:小區選擇的接收電平值
RSCP:
Qrxlevmin：小區要求的最小接收電平值（sib3）
UE_TXPWR_MAX_RACH: 網路最大允許的 上行 發射功率，SIB3中配置。該引數設定的越大，UE選擇該小區駐留越困難；設定越小，則越容易，但是有可能造成UE駐留該小區之後，不能正確接收PCCPCH承載的系統訊息
P_MAX: 手機最大的發射功率。 https://wenku.baidu.com/view/dfdde6146c175f0e7cd13750.html
*************step 7 RRC checks that the NAS supplied MCC-MNC matches with that received on BCH of newly acquired cell****************
03:00:43.931170 WCDMA RRC/High [ rrccsputil.c 20995] frequency 10663 band 1024 added to available PLMN list1
03:00:44.291171 WCDMA RRC/High [ rrccspdb.c 1651] Updated: PLMN 460-1 freq 10663 scr_code 8048 band 1024 CSG ID -1; num_csg_entries:0, curr_wr_index:1 in Acq DB1 03:00:44.291146 WCDMA RRC/High [ rrccspdb.c 1843] CSG: Added: PLMN 460-1, CSG ID -1; num_csg_entries: 0, curr_wr_index: 12
*************step8 評估S準則 (S criteria) ************
注： 小區重新是R準則（Ranking演算法） 該過程用不到 rrcdata|rrccsputil
03:00:44.291171 WCDMA L1/High [ l1mcmd.c 1676] Received CELL_SELECTION_REQ1
03:00:44.291171 WCDMA RRC/High [ rrccsp.c 5731] Qualmin -18, Rxlevmin -115, MaxULTxPower 24
03:00:44.293723 WCDMA L1/High [ wsrch.c 28228] Qqualmin -18 Qrxlevmin -115 2*ecio=-5 2*squal=31 srxlv=40 rscp=-74
03:00:44.293723 WCDMA RRC/High [ rrccsp.c 14271] S criteria is met. curr_scan 0, splmn 1, g_srch_done 0,bcch_nas_match = 1, nas_eplmn = 0, bcch_eplmn = 01
03:00:44.293723 WCDMA L1/High [ wsrch.c 28265] Cell Selection Succeed, List srch cnt:11
說明：
2*Squal = 2*ecio-2*Qqualmin= -5+2*18= 31>0
Srxlev = RSCP-Qrxlevmin-max{UE_TXPWR_MAX_RACH-P_MAX,0}
=-74+115-max(24-23,0)
=40
Qrxlevmin and UE_TXPWR_MAX_RACH is from SIB3
Qqualmin is from SIB3
https://www.docin.com/p-302506100.html
P_MAX: UE 最大發射功率
後續駐網後，在測量報告中也可以持續看到該值
【0x412F】UL_DCCH Measurement Report
Channel Type = UL_DCCH, Radio Bearer ID = 2, Uarfcn = N/A, Psc = N/A, Message Length = 22
message measurementReport :
{
measurementIdentity 5,
measuredResults intraFreqMeasuredResultsList :
{
{
modeSpecificInfo fdd :
{
primaryCPICH-Info
{
primaryScramblingCode 42
},
cpich-Ec-N0 0,
cpich-RSCP 1
}
},
*****************step9 NAS Initiates “Registration*****************************
03:00:44.308020 NAS MM/High [ mmsend.c 1480] DS: SUB 1 =MM= MM sent MMR_CAMPED_IND RAT : 1, BAND : 4194304
03:00:44.309009 NAS MM/High [ gmmmsg.c 3388] DS: SUB 1 =MM= Sending ATTACH REQUEST message
03:00:44.309009 NAS MM/High [ mmsend.c 3609] DS: SUB 1 =MM= MM sent MMR_CELL_SERVICE_IND: hsdpa_supp=3, dtm_supp=0, egprs_supp=0
****************step10 OTA 互動*****************************
03:00:44.362030 [0x412F] UL_CCCH RRC Connection Request We send this message on the RACH
Channel Type = UL_CCCH, Radio Bearer ID = 0, Uarfcn = 10663, Psc = 503, Message Length = 15
plmn-Identity :mcc 460 mnc 01
establishmentCause registration,
03:00:44.370155 WCDMA L1/High [ wenc.c 7687] PrCPICH_P 33, CPICH_RSCP -75, UL_IF -105 const_val -20, Preambl_P -17, TFCI 01
Primary CPICH TX power (SIB 5)
CPICH_RSCP (UE measurement)
UL interference (SIB 7）
Constant Value (SIB 5)
Preamble_Initial_Power= 33-(-75)+(-105)+(-20) = -17
03:00:44.415546 WCDMA L1/Fatal [ wenc.c 11096] UL_RACH: RACH Tx successful, TxAgc -13, ai_Sum 6e66 Free Add:01
03:00:44.415546 WCDMA L2/High [ macrach.c 1061] rcvd L1_PRACH_ACK from L11
************step11 NAS REG 更新註冊狀態**************
2020 Sep 2 03:00:44.306 [D7] 0x4127 WCDMA Cell ID
UTRA UL Absolute RF channel number = 9713
UTRA DL Absolute RF channel number = 10663
Cell identity (28-bits) = 100834611
URA to use in case of overlapping URAs = 1
Cell Access Restrictions:
Cell Barred = FALSE
Cell Reservered = FALSE
Cell Reserved for SolSA = FALSE
UE Camped on Cell = TRUE
Allowed Call Access = All Calls
PSC (Primary Scrambling Code) = 8048
PLMN = 460 - 01F
LAC id = 53506
RAC id = 1
03:00:45.868987 NAS REG/High [ reg_state.c 11165] DS: SUB 1 =REG= CS_PS_SERVICE on HPLMN(460-1)
***********step12 通知AP*************************
03:00:45.870003 [0x1544] QMI_MCS_QCSI_PKT
packetVersion = 2
MsgType = Indication
Service_NAS {
nas_sys_info_indTlvs[3] {
Type = 0x18
Length = 33
wcdma_sys_info {
common_sys_info {
srv_domain_valid = true
srv_domain = SYS_SRV_DOMAIN_CS_PS
srv_capability_valid = true
srv_capability = SYS_SRV_DOMAIN_CS_PS
roam_status_valid = true
roam_status = NAS_SYS_ROAM_STATUS_OFF
is_sys_forbidden_valid = true
is_sys_forbidden = false
}
threegpp_specific_sys_info {
lac_valid = true
lac = 53506
cell_id_valid = true
cell_id = 100834611
reg_reject_info_valid = false
reg_reject_info {
reject_srv_domain = SYS_SRV_DOMAIN_NO_SRV
rej_cause = 0
}
network_id_valid = true
network_id {
mcc = { 4, 6, 0 }
mnc = { 0, 1, (invalid) }
}
}
wcdma_specific_sys_info {
hs_call_status_valid = true
hs_call_status = SYS_HS_IND_HSDPA_HSUPA_UNSUPP_CELL
hs_ind_valid = true
hs_ind = SYS_HS_IND_HSDPA_HSUPA_SUPP_CELL
psc_valid = true
psc = 503
}
}
}
四 從切比雪夫不等式看駐網時間
切比雪夫 證明比較簡單，主要是可以看出當前測量值，和期望值之間誤差上限概率。
這個如何應用：
影響駐網： UE由於受到CPU,RF,網路互動，記憶體等因素影響（可以算相關係數）
每次駐留網路都偏差很大。
： 作為與期望駐網時間的誤差t
: 實際測試出來的駐網時間方差
根據實際頻率，算出數學期望，可以動態的調整該值。
相關文章
- 學員會診之03：你那慘不忍睹的三層架構架構
- 三層架構及分層架構
- 三層架構理解架構
- MVC 與三層架構MVC架構
- 分層架構和SOA架構
- Java三層架構sshJava架構
- .Net三層架構 (轉)架構
- 層次式架構案例架構
- osi7層架構圖架構
- 三層架構與養豬架構
- Vue底層架構及其應用Vue架構
- docker架構和底層技術Docker架構
- 區塊鏈的底層架構區塊鏈架構
- 前端架構思想：聚類分層前端架構聚類
- 4+2 分層架構 - Ricardo架構
- 探索小程式底層架構原理架構
- 軟體架構分層方法論架構
- 三層架構是什麼意思 ?架構
- MVC與三層架構區別MVC架構
- 細說五層網站架構網站架構
- 說說三層架構和MVC架構MVC
- ASp.net 剖析三層架構ASP.NET架構
- .NET應用架構設計—重新認識分層架構（現代企業級應用分層架構核心設計要素）應用架構
- MVC專案實踐,在三層架構下實現SportsStore,從類圖看三層架構MVC架構
- MVC專案實踐,在三層架構下實現SportsStore-03,Ninject控制器工廠等MVC架構
- HashMap原理(一) 概念和底層架構HashMap架構
- 深度解析HashMap底層實現架構HashMap架構
- 統一接入層架構的演進架構
- 架構師之路-https底層原理架構HTTP
- 計算機的層次化架構計算機架構
- Java Web(八) MVC和三層架構JavaWebMVC架構
- 三層架構--理論與實踐架構
- DB2 pureScale的三層架構DB2架構
- iOS 網路層架構設計分享iOS架構
- 瞭解ASP.NET底層架構ASP.NET架構
- OSI七層與TCP/IP五層網路架構詳解TCP架構
- 基於.NET的LINQ to SQL 三層架構開發之架構建立SQL架構
- 軟體架構設計原則和模式（上）：分層架構設計架構模式