前言：
CBS 服务目前主要在海外国家应用比较广泛。包括地震,深林火灾，洪水等预警，是GSM服务的一种应用场景。
WCMDA 后主要是BMC，解码流程差多不多。这边重点讲解一下GSM上的CBS
主要参考文档：
23041-f50 23041_CR0057_(Rel-10)_C1-103152 22268-g10
CBS模块的主要功能包括：
CBS根据 Message Identifier 进行划分， 使用独立的channels（65000), 9.4.1.2.2 Message Identifier
channels 0-999可以由用户开启,
channels from 999 to 65,000 可以通过OTA 激活 ，用户可以关闭所有channels
关键字
CBS: cell broadcast Services, 主要用于在特定的网络传播天气，交通等信息，地震，火灾等信息。
BMC: Broadcast/Multicast Control
CBCH: Cell Broadcast Channel 小区广播信道
SDCCH: Stand-Alone Dedicated Control Channel），全称是独立专用控制信道
（用在分配TCH之前呼叫建立过程中传送系统信令。例如位置更新消息、短消息、鉴权消息、加密命令及处理各种附加业务在此信道上进行。
上行和下行信道，点对点方式传播。一般进行的信令交互主要利用SDCCH信道承载，SDCCH信道的分配也称立即指配过程。有时还会进行短信传输。
CB ：消息可以在SDCCH/4 或者 SDCCH/8上面传输
WMS: wireless messaging services ,针对WCDMA
目錄
1: 架构
2： 协议栈实现
3：CB State Machine
4 BC message reception
5： 3GPP 解读
6： 关键字
一 架构
1.1 GSM 网络架构
1.2 UMTS 網絡架構
1.3 LTE 網絡架構
二 协议栈实现
2.1 协议栈架构图（2G_3G）
上层接口都是 WMS主要负责解码。 其中： CB模块主要负责调度，主要功能如下
2.2 知识点
1 CBCH 物理信道映射
针对实现：
ECBCH 能同时收8个Block, 每个block 51帧
CBCH 能同时收4个Block, 每个Block 51帧
CB 消息在SDCCH/4 或者SDCCH/8中传播。
每个CB消息包含23 octets。每页CB消息由4个CB块组成，在四个连续的51-frames多帧中传输
每页CBS ，分成4块，每块加一个octets(type)，type 低4位是代表sequecnce number, 高4位&0x60 必须是 0x01 协议描述
形成23个octets的SMS 消息，其中type 参考3GPP 23041_9.1 节
18:08:37.279337 [0x5384] GSM WMS CB Receive
Message:
serial_no
gs = 1 (0x1)
msg_code = 0 (0x0)
update_num = 0 (0x0)
msg_id
msg_id = 50 (0x32)
data_coding_scheme
coding = 8 (0x8)
page_parameter
current_page = 1 (0x1)
total_pages = 1 (0x1)
user_data_7_bit[0] = 79 (0x4f) (0x4f O)其中 slot(received_fn 计算出来) 和 seunce_number(0-8,block[0]低4位) 必须满足如下关系，否则为无效的block
slot =( fn/51)%8; fn
block_type= (block[0] & 0x60)>>5; 高四位为类型
sequence_number = bock_type&0x0F；低4位为sn
2.3： DRX NON-DRX
如果网络支持CB DRX 功能，则在 CB/extended CB 通道 传输schedule message，达到终端省电的效果。
UE根据 message bitmap 以及 message description , 使用schedule messages 收发。
non-drx 模式则持续扫描
三 CB State Machine
这里主要针对GSM场景下面, 分为 IDLE 和 Active 状态,Active 状态才可以收CBS消息。主要由两种场景触发
3.1：CB_SEARCH_LIST_REQ
cb_search_list_service_handler
条件：
A1: cb_search_list>0
A2: cb_search_list ==0
A3: actvie_rat= GSM& Same Cell(SUB,SUPER) & active_rat= super_active& SUBSET
A4: !C
A5 active_rat= GSM &&!( Same Cell(SUB,SUPER) & active_rat= super_active& SUBSET)
3.2 小区或者注册状态发生变化 RR_CELL_CHANGE_ID
B1: cb_support(SIB4 消息）
B2: cb_support==False
B3: cb_support & 当前搜寻列表为SUBSET & 激活SIM卡为SUPERSET & SUSET SIM卡小区和目前小区相同
B4 cb_support & !(当前搜寻列表为SUBSET & 激活SIM卡为SUPERSET & SUSET SIM卡小区和目前小区相同）
B5: 小区发生变化
3.1 CBCH_INACTIVE.：
如果搜寻列表为空，或者不支持CB 服务，就处于状态。
否则切换到CBCH_DETECTED 状态
3.2 CBCH_DETECTED
如果当前的SIM卡是 GSM模式, CELL跟另一张相同， 且搜寻列表为SUBSET(当前的搜寻列表是另一张SIM卡的子集)，切换到CBCH_ACTIVATION_PENDING 状态
如果搜寻列表为空，或者小区不支持CB, 则切换到CB_INACTIVE.
否则切换到ACTIVE 状态（CB_SEARCH_LIST_REQ）进行NON DRX ACTIVATED.
3.3 CBCH_COLLECTION
搜寻列表为空的时候，切换到 CB_INACTIVE状态
如果当前的SIM卡是 GSM模式, CELL跟另一张相同， 且搜寻列表为SUBSET(当前的搜寻列表是另一张SIM卡的子集)，切换到CBCH_ACTIVATION_PENDING 状态
否则切换到ACTIVE 状态（CB_SEARCH_LIST_REQ）进行NON DRX ACTIVATED.
3.4 CBCH_ACTIVATION_PENDING
如果当前小区不支持CBS ，切换到CBCH_COLLECTION 状态
如果当前不满足“” 当前的SIM卡是 GSM模式, CELL跟另一张相同， 且搜寻列表为SUBSET“，切换到CBCH_ACTIVE,进行NON DRX ACTIVATED
3.5 CBCH_ACTIVE
如果小区不支持CBS,切换到 CBCH_COLLECTION状态
如果满足 “” 当前的SIM卡是 GSM模式, CELL跟另一张相同， 且搜寻列表为SUBSET“，CBCH_ACTIVATION_PENDING
否则，如果小区发生变化，进行 NON DRX ACTIVATED
CB_SCHEDULING_REQ=》 cb_process_scheduling_table 发到L1 层进行DRX模式读取
为了使UE能够读取空闲消息时隙CB（读取建议和可选读取）消息
NV_SMS_BMC_READING_PREF_I(2826) as follows:
1 – Reading advised
1 – Optional reading
四 BC message reception
4.1 进入Non Drx Mode ,进行调度
主要有两种场景,一种是小区发生变化的时候，还有一种CB_SEARCH_LIST_REQ 请求的时候
//step1 确认网络是否支持cell broadcast,(对非SIM卡中，比如APP传递过来的CBS 服务有影响）
14:20:23.783003 [0x5B2F] RR/DSDS RR/BCCH DL/System Information Type 4
rr_man_prot
SYSTEM_INFORMATION_4
loc_area_ident
mcc_1 = 7 (0x7)
mcc_2 = 2 (0x2)
mcc_3 = 4 (0x4)
mnc_3 = 15 (0xf)
mnc_1 = 0 (0x0)
mnc_2 = 5 (0x5)
cbch_chan_desc_incl = 1 (0x1)
cbch_chan_desc
chan_type_tdma_offset = 10 (0xa)
timeslot_num = 1 (0x1)
train_seq_code = 2 (0x2)
hopping_chan = 0 (0x0)
abs_rf_chan_num = 244 (0xf4)
cbch_mob_alloc_incl = 0 (0x0)
------------------------------------------------
14:20:25.196042 GSM L1/High [ l1_smscb.c 1009] gs1:L1_CBCH: Basic CBCH supported 1
14:20:25.196042 GSM L1/High [ l1_smscb.c 1054] gs1:L1_CBCH: CBCH channel SDCCH_8
//step2 SCHEDULING(调度开始，进入NON DRX 模式）
14:20:25.196042 NAS CB/High [ cb_utils.c 3624] DS: SUB 1 CB: Sending CB_SCHEDULING_REQ(CB_NON_DRX_MODE) request
14:20:25.196063 EVENT_UMTS_NAS_CB_CTCH_STARTSubscription ID = 1, Rat Type = GSM, Ctch Mode = Non-DRX, Ctch Allocation Period = 0, Scheduling Period Length = 0, Scheduling Period Length in SFN = 0
PS : 14:21:09.041431 EVENT_NAS_CB_CTCH_STOP Subscription ID = 1, Rat Type = GSM//对应的也会有停止DRX模式
//GSM RR层 上报 RRC_CELL_CHANGE_IND ,Enter None DRX mode
14:21:11.726009 LOCATION_UPDATE_REQUEST Direction: MS To Network Length: 15
14:21:12.653527 LOCATION_UPDATE_REJECT Direction: Network To MS Length: 3
14:21:11.722031 NAS CB/High [ cb_state.c 2037] DS: SUB 1 CB: Received RR_CELL_CHANGE_IND, cb_gsm_feature_disabled=0
14:21:11.722031 NAS CB/High [ cb_state.c 1423] DS: SUB 1 CB: Moved into ACTIVE state
14:21:11.722031 NAS CB/High [ cb_state.c 3305] DS: SUB 1 CB substate change from 0 to 1, action:0(1 作为下一个状态的current_state)
0： IDLE 1: ACTIVE
14:21:11.722031 NAS CB/High [ cb_state.c 1632] DS: SUB 1 CB Service ID list:1 ID-0:0 ID-1:0
14:21:11.722031 NAS CB/High [ cb_state.c 1664] DS: SUB 1 BMC: PLMN 27 F4 1, LAC 1B C7, CELL ID 9D220000
14:21:11.722031 NAS CB/High [ cb_utils.c 3624] DS: SUB 1 CB: Sending CB_SCHEDULING_REQ(CB_NON_DRX_MODE) request
14:21:11.722039 EVENT_UMTS_NAS_CB_CTCH_STARTSubscription ID = 1, Rat Type = GSM, Ctch Mode = Non-DRX, Ctch Allocation Period = 0, Scheduling Period Length = 0, Scheduling Period Length in SFN = 0
Subscription ID = 1
Rat Type = GSM
Ctch Mode = Non-DRX
Ctch Allocation Period = 0
Scheduling Period Length = 0
Scheduling Period Length in SFN = 0
//after 30secs stop
14:21:47.494001 EVENT_NAS_CB_CTCH_STOP Subscription ID = 1, Rat Type = GSM
4.2 调度流程
调度消息格式
其中 Mssage bitmap 如下
NMI
1:读取CB Page CBMS Descritption
0: 根据NV2826 决定是否读取相关的CB pages(默认都是0）
Message descritption
MDT(Message descritption type)
先看bit8 :如果为1 则为广播的内容，即用户或SIM卡里面读取的channel
00:
18:08:29.041146 NAS CB/High [ cb_state.c 1957] DS: SUB 2 CB: Received DL_CB_BLOCK_IND FN:1743800
18:08:29.041146 NAS CB/High [ cb_msg_asm.c 1126] DS: SUB 2 CB: Null block -> can skip the rest of blocks
18:08:29.041146 NAS CB/High [ cb_state.c 1816] DS: SUB 2 CB: Received invalid CB BLOCK
18:08:29.041146 NAS CB/High [ cb_utils.c 2097] DS: SUB 2 CB: Sending CB_SKIP_REQ request with length == 3
18:08:29.041146 NAS CB/High [ cb_utils.c 2101] DS: SUB 2 CB: CB_SKIP_REQ->FN[0] == 1743851
18:08:29.041146 NAS CB/High [ cb_utils.c 2101] DS: SUB 2 CB: CB_SKIP_REQ->FN[1] == 1743902
18:08:29.041146 NAS CB/High [ cb_utils.c 2101] DS: SUB 2 CB: CB_SKIP_REQ->FN[2] == 1743953
18:08:29.041146 NAS CB/High [ cb_utils.c 378] DS: SUB 2 CB: Sending l1 request(23,1)
五 3GPP 解读
主要参考3GPP
23041-f50
23041_CR0057_(Rel-10)_C1-103152
22268-g10
解码比较简单： 给出Python的例子
# -*- coding: utf-8 -*-
"""
Created on Mon Feb 22 15:16:24 2021
@author: chengxf2
"""
#3GPP 23041-9.4.1.1
import numpy as np
CB_GS_POS = 0x00
CB_GS_MASK = 0xC0
#Mask :Octet1 00 11 1111
#Mask Octet2 1111 0000
CB_MESSAGE_CODE_HIGH_POS = 0x00
CB_MESSAGE_CODE_HIGH_MASK = 0x3F
CB_MESSAGE_CODE_LOW_POS =0x01
CB_MESSAGE_CODE_LOW_MASK = 0xF0
CB_UPDATE_NUMBER_POS =0x01
CB_UPDATE_NUMBER_MASK = 0x0F
#3-4
CB_MESSAGE_ID_POS = 0x02
#6
CB_PAGE_PARAM_POS = 0x05
CB_PAGE_TOTAL_MASK = 0x0F
CB_PAGE_CURRENT_MASK = 0xF0
def Get_CB_Block(type1):
if 0== type1:
CB_Message =[0, 0, 0, 50, 8, 17, 212, 100, 19, 52, 133, 130, 98, 177, 70, 163,
209, 104, 52, 26, 141, 70]
else:
CB_Message = [ 64, 0, 0, 50, 8, 17, 207, 36,
104, 10, 5, 197, 98, 141, 70, 163,
209, 104, 52, 26, 141, 70, 163, 209,
104, 52, 26, 141, 70, 163, 209, 104,
52, 26, 141, 70, 163, 209, 104, 52,
26, 141, 70, 163, 209, 104, 52, 26,
141, 70, 163, 209, 104, 52, 26, 141,
70, 163, 209, 104, 52, 26, 141, 70,
163, 209, 104, 52, 26, 141, 70, 163,
209, 104, 52, 26, 141, 70, 163, 209,
104, 52, 26, 141, 70, 163, 209, 0]
return CB_Message
def parse_paging_block(block):
gs = (block[CB_GS_POS]&CB_GS_MASK)>>6
msg_code_high = (block[CB_MESSAGE_CODE_HIGH_POS]&CB_MESSAGE_CODE_HIGH_MASK)<<4
msg_code_low = (block[CB_MESSAGE_CODE_LOW_POS]&CB_MESSAGE_CODE_LOW_MASK)>>4
msg_code = msg_code_high|msg_code_low
update_number = block[CB_UPDATE_NUMBER_POS]&CB_UPDATE_NUMBER_MASK
Message_ID = (block[CB_MESSAGE_ID_POS]<<8)|block[CB_MESSAGE_ID_POS+1]
total_page = (block[CB_PAGE_PARAM_POS]&CB_PAGE_TOTAL_MASK)
current_page = (block[CB_PAGE_PARAM_POS]&CB_PAGE_CURRENT_MASK)>>4
print("\n gs: ",gs,"\t msg_code ",msg_code," update_number: ",update_number," msg_id ",Message_ID, "Current page:",current_page
," total_page ",total_page)
block = Get_CB_Block(1)
parse_paging_block(block)
===LOG==
18:08:09.971250 [0x7159] UMTS NAS CB Ota log packet
Version = 0
Subscription ID = 1
Rat Type = GSM
Message Type = Data Message
Message Length = 22
CB Message = {
0, 0, 0, 50, 8, 17, 212, 100,
19, 52, 133, 130, 98, 177, 70, 163,
209, 104, 52, 26, 141, 70
}
18:08:09.971250 [0x5384] GSM WMS CB Receive
Message:
serial_no
gs = 0 (0x0)
msg_code = 0 (0x0)
update_num = 0 (0x0)
msg_id
msg_id = 50 (0x32)
data_coding_scheme
coding = 8 (0x8)
page_parameter
current_page = 1 (0x1)
例如
Begin slot number 1： 如果非1 ，则为非调度消息
End slot number 25： 最大为48， 消息位图中最后一个消息slot
Message bitmap (Hex) E0 0F C0 70 00 00.
如E0 : 1 1 1 0,0 0,0,0
代表NM1, NM2 ,MM3 =1,其余为0，要读取slot1,2,3,其余为0 ，则根据NV 中配置决定是否读取
Message description (Hex) A2 31 01 41 40
解码：
A2: 10 10 0010
MDT: 10
高字节部分： 0010
低字节部分： 31
则Message identifier =0x2231
Scheduling period 25
01： 00 00 0001
MDT:00
Repeated slot number :1
Second message transmitted is repetition of the message (MDT 00)
Third message is reading advised (MDT 0x41)
Fourth message is reading optional (MDT 0x40)
六 WMS 关键字
qmi_wms|wmsmsg| wmsbc|cb_msg_asm|cb_state|cb_utils
Moved into|0x5384|0x7159|WMS_MESSAGE_FORMAT_GW_BC|cbch_chan_desc_incl = 1 (0x1)(sib4)
4954
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
