做盗版视频网站成本多少,手机排名,网站制作流程 优帮云,网站建没有前景suci
5G终端第一次驻网时#xff0c;注册消息Registartion request中携带的5GS mobile identity要携带suci类型的mobile identity。 注册消息协议规范见5G NAS 协议3gpp TS24.501 8.2.6 Registration request。 suci协议规范参见3gpp TS24.501 9.11.3.4 5GS mobile identity …suci
5G终端第一次驻网时注册消息Registartion request中携带的5GS mobile identity要携带suci类型的mobile identity。 注册消息协议规范见5G NAS 协议3gpp TS24.501 8.2.6 Registration request。 suci协议规范参见3gpp TS24.501 9.11.3.4 5GS mobile identity 从上面协议内容可知携带suci的注册消息中有Routing indicator字段。为两个字节。包含digit1到digit4. 其值从digit1开始存放如果后面的digit不使用则为FF。 比如上面note2的例子如果RoutingIndicator为3位。那么digit1 digit2 digit3 存RoutingIndicator的值。digit4要填为FF。
何时注册携带suci
UE注册时如果UE既有5G-GUTI又有SUCI那注册请求中用5G-GUTI否则用SUCI。但绝不能用SUPI。为了隐私和安全SUPI在5G的空口中禁止传递。
3GPP 5G PROC协议TS 23.502的4.2.2.2.2 General Registration注册流程描述如下 依次是GUTI映射或native的guti。都没有最后才是SUCI。
开源代码UERANSIM 的MmRegistration.java中sendRegistration函数
日志分析
终端在某5G专网能搜到网络但是不向网络发送Registration Request注册网络。
首先分析网络的SIB消息
00:47:04.546945 RRC/HighFreq/High/NR5GRRC [nr5g_rrc_sib.c 1792] Sending NR5G_CPHY_SIB_SCHED_REQ. sibs_to_acq_curr - 0x0, sibs_to_acq_next - 0x0
00:47:04.547088 RRC/HighFreq/High/NR5GRRC [nr5g_rrc_meas.c 18428] DL carrier freq : 7880, scs : 1, mtc_periodicity : 0, priority : 0, band : 77
//如下日志说明sib4消息的dl_CarrierFreq配置有误
00:47:04.547223 RRC/HighFreq/High/NR5GRRC [nr5g_rrc_meas.c 17445] SIB4 omitted, dl_CarrierFreq 7880 msimatch valid band, skip
00:47:04.547233 RRC/HighFreq/High/NR5GRRC [nr5g_rrc_meas.c 18043] MEAS:Eutra carrierFreq 40890, not supported
网络下发的 dl-CarrierFreq 7880 不是 freqBandIndicatorNR 77的合法频点。。 3GPP TS38.101-1协议的 Table 5.4.2.3-1: Applicable NR-ARFCN per operating band可以查看每个band的dl频点范围。从如下截图可以看出7880不在下行频点范围。
如下是sib4的字段内容 sib4 : {interFreqCarrierFreqList {{dl-CarrierFreq 7880,frequencyBandList {{freqBandIndicatorNR 77}},ssbSubcarrierSpacing kHz30,deriveSSB-IndexFromCell TRUE,q-RxLevMin -60,t-ReselectionNR 1,threshX-HighP 30,threshX-LowP 22,threshX-Q {threshX-HighQ 30,threshX-LowQ 22},q-OffsetFreq dB-20}}}不过interFreqCarrierFreqList 是用来NR interFreq重选相关的参数。应该不会导致终端连注册消息都不发。
终端确实在附近的时间点退出了NR5G模块。需要定位是哪里发送了NR5G_RRC_DEACTIVATE_REQ NR5G_RRC_STACK_DEACTIVATE_REQI。
00:47:04.557373 RRC/HighFreq/High/NR5GRRC [ nr5g_rrc_csp.c 13854] CSP: Received Deactivate request NR5G_RRC_DEACTIVATE_REQ. Reason : 0
00:47:04.558346 RRC/HighFreq/High/NR5GRRC [ nr5g_rrc_stackmgr.c 3494] RRCSM: Received NR5G_RRC_STACK_DEACTIVATE_REQI, at state 5, stop_cause 0, scen 17从终端日志和网络信令看网络的SIB没有明显错误导致终端不注册。 所以需要从终端上层NAS模块查看有无从NAS模块发送退出5G的命令。
查看上层协议日志
//这里看到终端已经成功搜到5G网络
00:47:04.486137 MM/HighFreq/High/REG [ reg_send.c 510] DS: SUB 0 REG CM_CAMPED_IND PLMN (XXX - XXX) Primary PLMN (XXX - XXX)
00:47:04.486170 MMODE/STRM/High/CM [ cmregprx.c 13148] NAS-CMREG: sub 0 stk 0, CM_CAMPED_IND
00:47:04.550872 MM/HighFreq/High/REG [ reg_mode.c 9558] DS: SUB 0 REG Home MCC XXX Home MNC XXX
00:47:04.554016 MM/LowFreq/High/REG [ reg_state.c 2973] DS: SUB 0 REG CM_SERVICE_REQ Scan Scope type0 network_selection_mode 2 Additional_info0 RAT Enabled BM 0x1000, BST BM 0x1000
00:47:04.554304 MM/LowFreq/High/REG [ reg_send.c 856] DS: SUB 0 REG CM_SERVICE_CNF scan_status:1 msg.service_state.service_status: 1
00:47:04.554305 MM/LowFreq/High/REG [ reg_send.c 880] DS: SUB 0 REG CM_SERVICE_CNF PLMN (XXX - XXX) Primary PLMN (XXX - XXX) blocked_for_no_voice 0
//但是不知为何NAS MM REG模块收到CM_STOP_MODE_REQ
00:47:04.557049 MM/LowFreq/High/REG [ reg_state.c 11751] DS: SUB 0 REG CM_STOP_MODE_REQ stop_mode_reason 0
//转换成MMR_STOP_MODE_REQ
00:47:04.557155 MM/HighFreq/High/REG [ reg_send.c 2302] DS: SUB 0 REG MMR_STOP_MODE_REQ sent trans_id 0x67
//进一步向5G RRC发送命令NR5G_RRC_DEACTIVATE_REQ
00:47:04.557275 MM/LowFreq/High/MM [ mm5g_rrc_if.c 434] DS: SUB 0 MM5G Sending NR5G_RRC_DEACTIVATE_REQ with reason 0
00:47:04.557350 MM/HighFreq/High/SM [sm5g_process_pdu_procedure.c 1805] DS: SUB 0 SM5G: NAS_MM5G_DETACH_IND Received,
进一步向上看日志卡模块抛出MMGSDI_SESSION_ILLEGAL_SUBSCRIPTION_EVT导致CM上报CM_PH_CMD_SUBSCRIPTION_NOT_AVAILABLE即卡无效。进而退出5G驻网流程。
00:47:04.550000 MM/HighFreq/High/MM [mm_multimode_handler.c 5456] DS: SUB 0 EMM Moving to DEREGISTERED STATE, Update EPS security_context...
00:47:04.550146 MMODE/STRM/High/CM [ cmmmgsdi.c 5559] UIM-CM: MMGSDI_SESSION_ILLEGAL_SUBSCRIPTION_EVT, session-id 103
00:47:04.550170 MM/HighFreq/High/SM [sm5g_process_pdu_procedure.c 1805] DS: SUB 0 SM5G: NAS_MM5G_DETACH_IND Received,
00:47:04.550179 MMODE/DEBUG/Low/CM [ cm.c 9886] -CM: phcmd 8: CM_PH_CMD_SUBSCRIPTION_NOT_AVAILABLE, cdma 1, gwl 0 sub 0, curr 5, true 5, active_subs 1, is_msim 100:47:04.550589 MMODE/STRM/High/CM [ cmph.c 19463] PH_PROC: sub 0, CM_PH_CMD_SUBSCRIPTION_NOT_AVAILABLE is being processed cause:0, 5 1 0 0
00:47:04.550593 MMODE/STRM/High/CM [ cmph.c 19473] SUBSCRIPTION_NOT_AVAILABLE sub_asub_id 0 1x_sub 0
00:47:04.550599 MMODE/STRM/High/CM [ cmph.c 19554] SUBSC_NOT_AVAIL: sess_type 0 app_type 3
00:47:04.550702 MM/HighFreq/High/REG [ reg_state.c 13082] DS: SUB 0 REG LIMITED_SERVICE on HPLMN(XXX-XXX)
00:47:04.550760 MM/LowFreq/High/REG [ reg_send.c 880] DS: SUB 0 REG CM_SERVICE_CNF PLMN ( XXX- XXX) Primary PLMN (XXX - XXX) blocked_for_no_voice 0
00:47:04.552409 MMODE/STRM/High/CM [ mmoc.c 5778] MMOC-PROT: DEACT_REQ to ACTIVE protocol: 5, reason: 6, sub 0 stk 0, insanity_count 0, ps_enabled 1
00:47:04.552414 MMODE/DEBUG/Low/CM [ mmocdbg.c 1091] After event was processed: Curr_trans 1(SUBSC_CHGD), Trans_state 2(WAIT_DEACTD_CNF)
00:47:04.556994 MMODE/STRM/High/CM [ cmregprx.c 4772] CMREG-NAS: sub 0 stk 0, Send STOP_MODE_REQ, reason0
00:47:04.557017 MMODE/DEBUG/Low/CM [ cmregprx_dbg.c 302] MMOC-CMREG: PROT_CMD_DEACTIVATE:trans_id 89 Reason 6, sub 0 stk 0
00:47:04.557049 MM/LowFreq/High/REG [ reg_state.c 11751] DS: SUB 0 REG CM_STOP_MODE_REQ stop_mode_reason 0
00:47:04.557155 MM/HighFreq/High/REG [ reg_send.c 2302] DS: SUB 0 REG MMR_STOP_MODE_REQ sent trans_id 0x67卡流程哪里出问题了呢 从下面日志可知终端第一次注册进入向网络发送registration Request的流程。 Start registration procedure, reg type 1, 由于第一次注册终端没有GUTI所以需要携带SUCI给网络。所以向卡发送生成SUCI的命令。即SUCI generation request sent to MMGSDI。 但是卡回复的SUCI的routing indicator有误。digit1 15, digit2 1, digit3 15, digit4 15。 按协议15为FF即不不使用。比如如果routing indicator是3位那么digit1 digit2 digit3 为非FF的值digit4为FF. 但是卡返回的digit1 15, digit2 1。 不可能digit1无效而digit2中有有效值。所以routing indicator校验失败。日志打印SUCI parsing failed。 终端无法获取SUCI就无法注册网络进而无法驻网。
此问题到这里比较清楚了专网卡有问题生成suci中包含的的routing indicator无效导致终端无法发送注册消息进而终端无网络。
00:47:04.486137 MM/HighFreq/High/REG [ reg_send.c 510] DS: SUB 0 REG CM_CAMPED_IND PLMN (xxx - XXX) Primary PLMN (XXX- XXX)
00:47:04.486139 MM/HighFreq/High/MM [mm5g_registration_handler.c 1103] DS: SUB 0 MM5G Start registration procedure, reg type 1, reset_attempt_counter 1, attempt counter 0, REG Cause BM 0x0 CS-For 0
00:47:04.486157 MM/HighFreq/High/REG [ reg_state.c 1461] DS: SUB 0 REG sent message MS: 48 MSG_ID: 0
00:47:04.486236 MM/HighFreq/High/MM [ mm5g_security.c 6788] DS: SUB 0 MM5G SUCI generation request sent to MMGSDI
00:47:04.549614 MM/HighFreq/High/MM [ mm5g_security.c 7072] DS: SUB 0 MM5G Received SIM_MM_USIM_GET_SUCI_CNF, SUCI data len 53
00:47:04.549617 MM/HighFreq/Error/MM [ mm5g_security.c 6988] DS: SUB 0 MM5G MMGSDI returned incorrect routing inddigit1 15, digit2 1, digit3 15, digit4 15
00:47:04.549620 MM/HighFreq/Error/MM [ mm5g_security.c 7087] DS: SUB 0 MM5G MMGSDI returned status 0 in GET_SUCI_CNF or SUCI parsing failed00:47:04.549961 User Identity Module/High [ mmgsdisessionlib.c 6123] mmgsdi_session_manage_illegal_subscription0
00:47:04.549969 User Identity Module/High [ mmgsdisessionlib.c 6172] Queue of MMGSDI command: MMGSDI_SESSION_MANAGE_ILLEGAL_SUBSCRIPTION_REQ status 0x00
00:47:04.549996 User Identity Module/High [ mmgsdi_gen.c 2017] Application for session 72 is MARKED AS ILLEGAL BY REQUEST0
00:47:04.550070 User Identity Module/High [ qmi_uim.c 18401] qmi_uim_process_manage_illegal_card_evt with legal_status as 0x1000:47:04.549614 MM/HighFreq/High/MM [ mm5g_security.c 7072] DS: SUB 0 MM5G Received SIM_MM_USIM_GET_SUCI_CNF, SUCI data len 53
00:47:04.549617 MM/HighFreq/Error/MM [ mm5g_security.c 6988] DS: SUB 0 MM5G MMGSDI returned incorrect routing inddigit1 15, digit2 1, digit3 15, digit4 15
00:47:04.549620 MM/HighFreq/Error/MM [ mm5g_security.c 7087] DS: SUB 0 MM5G MMGSDI returned status 0 in GET_SUCI_CNF or SUCI parsing failed
Routing indicator含义
Routing Indicator是suci中的字段。 在TS 23.502的4.2.2.2.2 General Registration中指向了TS 33.501 5GS Architecture协议。查看此协议 Routing Indicator: An indicator defined in TS 23.003 [19] that can be used for AUSF or UDM selection. 即Routing Indicator用来注册时AMF选择AUSF或UDM。 AUSF或UDM存储终端的注册和绑定信息。 在TS23.003-i50 Numbering, addressing and identification协议中详细定义如下 即Routing Indicator路由指示符由归属网络运营商分配并在USIM中提供的1到4个十进制数字组成允许与归属网络标识符一起将包含SUCI字段的网络信令路由到能够为用户服务的AUSF和UDM实例。 路由指示器中的每个十进制数字都是有意义的例如值“012”与值“12”不同。如果USIM或ME上没有配置路由指示符则该数据字段应设置为值0即仅由一个十进制数字“0”组成即0FFF。 此问题中卡返回的Routing Indicator digit1 15, digit2 1, digit3 15, digit4 15即F1FF. 按照TS24.501 协议只有不使用的高位数字才可以为15FF。所以卡应该返回 digit1 1, digit2 15, digit3 15, digit4 15.
如果卡不指定AUSF和UDM则卡应该返回 digit1 0, digit2 15, digit3 15, digit4 15. 参考链接 https://articles.zsxq.com/id_ful8uwunrrcj.html (1) 初始注册流程关键步骤分析 UE-ID 为suci https://articles.zsxq.com/id_hgcezzezpli2.html 学习UERANSIM源码-registation相关文件 https://blog.csdn.net/qq_31985307/article/details/126440655 5G NR系列文章-5G标识符SUPI和SUCI
