1【测试目的】
CCCH mapped to UL SCH/ DL-SCH / Reserved Logical Channel ID
主要测试的是 CCCH映射到UL-SCH, DL-SCH 和保留LCID的功能.
CCCH 映射到UL-SCH : RRC connection request
CCCH 映射到DL-SCH: RRC connection setup
CCCH 映射到保留LCID :01011 to 11011
2【测试条件】
LTE Rel8 and UEs supporting E-UTRA
3【PASS LOG 信令流程一览】
![](https://i-blog.csdnimg.cn/blog_migrate/8c800b84f3c75359ef365e787435c912.jpeg)
4【测试流程】
(1)
with { UE in E-UTRA RRC_IDLE state and after transmitting a RRCConnectionRequest message }
ensure that {
when { UE receives a MAC PDU on DL SCH and addressed to its T-CRNTI but including a reserved value for LCID }
then { UE discards the MAC PDU }
}
(2)
with { UE in E-UTRA RRC_IDLE state and after transmitting a RRCConnectionRequest message }
ensure that {
when { UE receives a MAC PDU on DL SCH and addressed to its T-CRNTI with value ‘00000’B as LCID }
then { UE forwards to upper layers the disassembled and demultiplexed SDU on logical channel CCCH }
}
Table 7.1.1.1.3.2-1: Main behaviour
St | Procedure | Message Sequence | TP | Verdict | UE log and comments |
| | U - S | Message | | | |
| EXCEPTION: Steps 1 to 4 shall be repeated for decreasing reserved LCID values from 01011 to 11011. | - | - | - | - | 这里需要注意 step1-step4是一个循环的过程,意思就是说从01011(11) – 11011(27), 一共要有17个循环, 每个循环都会有paging. 【注意】:从LTER12甚至R13版本,对该描述一直都是01011 to 11011. 但是从LTE R10开始,11011已经被用于Activation/Deactivation。所以我认为协议应该对此做版本的区分,R9之前从01011到11011. R10之后从01011到11010 |
1 | The SS transmits a Paging message including a matched identity. | <-- | - | - | - | 2017 Jan 9 08:04:14.309 [62] 0xB0C0 LTE RRC OTA Packet -- PCCH / Paging Radio Bearer ID = 0, Physical Cell ID = 0 Freq = 300 SysFrameNum = 717, SubFrameNum = 9 PDU Number = PCCH Message, Msg Length = 7 SIB Mask in SI = 0x00 value PCCH-Message ::= { message c1 : paging : { pagingRecordList { { ue-Identity s-TMSI : { mmec '00000001'B, m-TMSI '11000010 00110100 01010110 01111000'B }, cn-Domain ps } } } } |
2 | The UE transmits an RRCConnectionRequest message. | --> | - | - | - | 2017 Jan 9 08:04:14.311 [32] 0xB0C0 LTE RRC OTA Packet -- UL_CCCH / RRCConnectionRequest Radio Bearer ID = 0, Physical Cell ID = 0 Freq = 300 SysFrameNum = N/A, SubFrameNum = 0 PDU Number = UL_CCCH Message, Msg Length = 6 SIB Mask in SI = 0x00 value UL-CCCH-Message ::= { message c1 : rrcConnectionRequest : { criticalExtensions rrcConnectionRequest-r8 : { ue-Identity s-TMSI : { mmec '00000001'B, m-TMSI '11000010 00110100 01010110 01111000'B }, establishmentCause mt-Access, spare '0'B } } } |
3 | The SS Transmits a valid MAC PDU containing RRCConnectionSetup, and Contention Resolution Identity MAC Control Elementexcept for LCID in MAC Header set to reserved value 11011 or lower (depending on iteration number). | <-- | MAC PDU | - | - | // RRC connection request 触发竞争性随机接入, Msg4里只含有CRI,没有RRC connection setup 2017 Jan 9 08:04:14.367 [2A] 0xB063 LTE MAC DL Transport Block SubPacket - ( DL Transport Block Subpacket ) --------------------------------------------------------------------------------- | | | | | | | | | | | | | |DL TBS |RLC |HDR | | | | |SFN |Sub-FN|RNTI Type |(bytes)|PDUs|LEN |Mac Hdr + CE |LC ID|LEN | --------------------------------------------------------------------------------- | 723| 7| T-C-RNTI| 7| 0| 7| 1C 40 1C 23 45 67 84 |CRID | 6| 2017 Jan 9 08:04:14.365 [18] 0xB16A LTE Contention Resolution Message (MSG4) Report Version = 1 SFN = 723 Sub-fn = 7 Contention Result = Pass UL ACK Timing SFN = 724 UL ACK Timing Sub-fn = 1 // LCID = 11, 即使该LCID里的数据是RRC connection setup. UE也不做解析,直接丢弃 2017 Jan 9 08:04:14.467 [CC] 0xB063 LTE MAC DL Transport Block SubPacket - ( DL Transport Block Subpacket ) --------------------------------------------------------------------------------- | | | | | | | | | | | | | |DL TBS |RLC |HDR | | | | |SFN |Sub-FN|RNTI Type |(bytes)|PDUs|LEN |Mac Hdr + CE |LC ID|LEN | --------------------------------------------------------------------------------- | 729| 2| C-RNTI| 26| 0| 1| 0B | 11| -1| |
| EXCEPTION: In parallel with step 4, UE may execute parallel behaviour defined in table 7.1.1.1.3.2-2 | - | - | - | - | |
4 | Check: For 5 seconds after Step3, does the UE transmit RRCConnectionSetupComplete message? | --> | RRCConnectionSetupComplete | 1 | F | // T300 (1000ms) expire 2017 Jan 9 08:04:15.311 [3D] 0x1FFB Event -- EVENT_LTE_RRC_TIMER_STATUS Payload String = Timer Name = T300, Timer Value = 0, Timer State = Expire // RRC 状态变为 Idle camped 2017 Jan 9 08:04:15.312 [3D] 0x1FFB Event -- EVENT_LTE_RRC_STATE_CHANGE Payload String = RRC State = Idle Camped |
5 | The SS transmits a Paging message including a matched identity. | <-- | - | - | - | 2017 Jan 9 08:06:03.108 [CA] 0xB0C0 LTE RRC OTA Packet -- PCCH / Paging |
6 | The UE transmits an RRCConnectionRequest message. | --> | - | - | - | 2017 Jan 9 08:06:03.109 [24] 0xB0C0 LTE RRC OTA Packet -- UL_CCCH / RRCConnectionRequest |
7 | The SS transmits a valid MAC PDU containing RRCConnectionSetup, and Contention Resolution Identity MAC Control Element and LCID in MAC Header set correctly to CCCH 00000 | <-- | MAC PDU | - | - | // LCID = 0, this LCID is valid. So UE will decode this MAC DL PDU. 2017 Jan 9 08:06:03.286 [4F] 0xB063 LTE MAC DL Transport Block SubPacket - ( DL Transport Block Subpacket ) --------------------------------------------------------------------------------- | | | | | | | | | | | | | |DL TBS |RLC |HDR | | | |SFN |Sub-FN|RNTI Type |(bytes)|PDUs|LEN |Mac Hdr + CE |LC ID|LEN | --------------------------------------------------------------------------------- | 349| 9| C-RNTI| 26| 1| 1| 00 | 0| -1| // UE receive the RRC connection setup 2017 Jan 9 08:06:03.267 [10] 0xB0C0 LTE RRC OTA Packet -- DL_CCCH / RRCConnectionSetup |
8 | Check: does the UE transmit an RRCConnectionSetupComplete message including SERVICE REQUEST message? | --> | RRCConnectionSetupComplete | 2 | P | P 2017 Jan 9 08:06:03.272 [7E] 0xB0C0 LTE RRC OTA Packet -- UL_DCCH / RRCConnectionSetupComplete |
9-12 | Steps 6 to 9 of the generic radio bearer establishment procedure (TS 36.508 4.5.3.3-1) are executed to successfully complete the service request procedure. | - | - | - | - | - |
【问题1】Paging 中的S-TMSI 是哪来的?UE怎么知道寻呼的是自己呢?
【答】:(1) paging ID 有两种,一种是S-TMSI, 代表此意寻呼是一次正常的寻呼,一种是IMSI,表明本次寻呼是一次异常寻呼,用于网络侧的错误恢复,此种情况下UE
需要重新做一次附着(Attach)流程。
(2) 实际上Paging 中的S-TMSI是在UE Attach request 中带的,如果Paging中的S-TMSI 和UE发送的Attach request中的S-TMSI一致,则认为该寻呼是对本UE的寻呼。
(3) S-TMSI 由mme code(1个字节) + M-TMSI(4个字节)组成。
(4) IMSI 有MCC+MNC+MSIN 组成
2017 Jan 9 08:04:00.002 [CA] 0xB0ED LTE NAS EMM Plain OTA Outgoing Message -- Attach request Msg
prot_disc = 7 (0x7) (EPS mobility management messages)
msg_type = 65 (0x41) (Attach request)
lte_emm_msg
emm_attach_request
tsc = 0 (0x0) (cached sec context)
nas_key_set_id = 0 (0x0)
att_type = 2 (0x2) (combined EPS/IMSI attach)
eps_mob_id
id_type = 6 (0x6) (GUTI)
odd_even_ind = 0 (0x0)
Guti_1111 = 15 (0xf)
mcc_1 = 0 (0x0)
mcc_2 = 0 (0x0)
mcc_3 = 1 (0x1)
mnc_3 = 15 (0xf)
mnc_1 = 0 (0x0)
mnc_2 = 1 (0x1)
MME_group_id = 32769 (0x8001)
MME_code = 1 (0x1)
m_tmsi = 3258209912 (0xc2345678)
【问题2】如果Paging 中Paging ID是IMSI,请问eNB又是如何得到的呢?
【答】UE在初始接入的时候,UE 会在attach request 里携带IMSI.??
【问题3】RRC connection request里的原因是mt-Access, 这是什么意思,都有哪些建立原因?
【答】根据TS36.331,有如下几个原因
(1) Emergency 拨打紧急号码
(2) highpriorityAccess 高优先级接入
(3) mt-Access 被叫接入
(4) mo-Signalling 主叫发送信令
(5) mo-Data 发送数据
(6) delayTolerantAccess
【问题4】怎么知道UE所支持的LTE的release 版本信息呢?
【答】可以查看UE capability, UE 会上报自己支持的LTE release 信息,如下所示:
2017 Jan 9 08:04:00.553 [57] 0xB0C0 LTE RRC OTA Packet -- UL_DCCH / UECapabilityInformation
value UE-EUTRA-Capability ::=
{
accessStratumRelease rel10, // LTE Rel10
ue-Category 4,
【参考】
1. RRC connection request 原因:http://blog.sina.com.cn/s/blog_746b60460102uy8c.html
2. LTE UE ID介绍:http://wenku.baidu.com/link?url=wNxN-U0VDvr7o5mDxddqcIHLXepihxsLM_UR2WVIrpobKsdQcvxA2DmP8RmWj5H5BCX9C7_5DnZWmc6c3NnlCjmsDfxaYGKTl6TZC6rPSSS