Overview

This section offers a brief description of the different layers which constitute the mobile station Protocol Stack. It is also intended to offer an overview of the intersystem interface. The Protocol Stacks are used to define the functionality of the GSM protocols for interfaces. The GSM specifications are normative when used to describe the functionality of interfaces, but the stacks and the subdivision of protocol layers do not imply or restrict any implementation.

1 PL - Physical Layer

The base of the Protocol Stack rests on the physical layer.

2 DL - Data Link

The Data Link Layer (DL) is used to handle an acknowlowdged connection between mobile and base station. The LAPDm protocol is used.

3 RR - Radio Resource

Radio Resource (RR) manages the resources of the air-interface. That means configuration of physical layer, cell selection and cell reselection, data transfer, RR-Connection handling.

4 MM - Mobility Management

Mobility Management (MM) handles registration aspects for the mobile station. It detects changes of location areas and updates a mobile station in the new location area.

5 CC - Call Control

Call Control (CC) provides the call functionality. This includes call establishment, call maintenance

procedures like Hold, Retrieve or Modify, and call disconnection.

6 SS - Supplementary Services

Supplementary Services (SS) handles all call independent supplementary services like call forwarding or call barring.

7 SMS - Short Message Services

Short Message Services (SMS) is used for sending and receiving point-to-point short messages. Additionally the reception of cell broadcast short messages is included. Call Control (CC), Supplementary Services (SS) and Short Message Services (SMS) together are referred to as Connection Management (CM) sometimes.

8 MMI - Man Machine Interface

The man machine interface (MMI) is the interface to the user. Normally it is connected with a keypad as input device and a display as output device. In G23, there is a AT Command Interpreter (ACI), therefore, sometimes the MMI is also referred to as ACI in the present document if “the layer above layer 3″ is to be identified.

Between the several entities data interfaces are defined. These data interfaces are called Service

Access Points (SAPs), indicating that an upper layer uses the services of a lower layer.

The GSM specification do not set out any implementation of the Protocol Stack. The following diagrams show the implementation described in all these documents for the mobile station. All entities Technical Document GSM Protocol Stack Message Sequence Charts MM (6147.203.97.102), v0.3 Draft

except the Man Machine Interface and Physical Layer are implemented as part of the Protocol Stack - with ACI seen as an integral part of the stack in almost all cases.

For GPRS, there are more entities.

9 GRR (RLC/MAC) – Radio Link Control/Medium Access Control

This layer contains two functions: The Radio Link Control function provides a radio-solution-dependent reliable link. The Medium Access Control function controls the access signalling (request and grant) procedures for the radio channel, and the mapping of LLC frames onto the GSM physical channel.

10 LLC – Logical Link Control

The LLC entity provides multiple highly reliable logical links for asynchronous data transfer between the MS and the network. It supports variable-length information frames, acknowledged and unacknowledged data transfer, flow and sequence control,error detection and recovery, notification of unrecoverable errors, user identity confidentiality, and ciphering of user and signaling data.

11 GMM – GPRS Mobility Management

The GMM entity provides procedures for the mobility of the MS, such as informing the network of its present location, and user identity confidentiality. It manages the GMM context (attach, detach, routing area updating), supports security functions such as authentication of user and MS, controls ciphering of data, and initiates the response to paging messages.

12 SM – Session Management

The main function of the session management (SM) is to support PDP context handling of the user terminal. Session Management activates, modifies and deletes the contexts for packet data protocols (PDP). Session Management services are provided at the SMREG-SAP and the SNSM-SAP for anonymous and non-anonymous access. The non-anonymous and anonymous access procedures for PDP context activation and PDP context deactivation are available at the SMREG-SAP.In addition there exists a PDP context modification for non-anonymous PDP contexts.

13 SNDCP - Subnetwork Dependant Convergence Protocol

SNDCP carries out all functions related to transfer of Network layer Protocol Data Units (N-PDUs) over GPRS in a transparent way. SNDCP helps to improve channel efficiency by means of compression techniques. The set of protocol entities above SNDCP consists of commonly used network protocols. They all use the same SNDCP entity, which then performs multiplexing of data coming from different sources to be sent using the service provided by the LLC layer.

14 GACI – GPRS Application Control Interface

The GACI is the GPRS extension of the ACI. It is specified in GSM 07.07 and 07.60. It is responsible for processing of the GPRS related AT Commands to setup, activate and deactivate the PDP context parameter. It also provides functionality for the interworking between GMM/SM/SNDCP and a packet oriented protocol like PPP.

15 GSMS - GPRS Short Message Service

Like GACI, GSMS, the GPRS Short Message Service, is also not a new entity of its own, but it is the GSM SMS entity enhanced by GPRS functionality.

（1）当内核完成它自己内部由一些目标依赖部分组成的启动程序后，它将调用Application_Initialize()函数，这是实体进入内核所有应用程序的入口点。

（2）调用在Application_Initialize()函数中StartFrame（）函数。这是实体对于框架来说的主要的进入点。StartFrame（）主要负责内存池的创建，任务中实体任务的创建，启动作为当前应用程序一部分的任务。

（3）用于进行通信的分区内存池通过os_CreateParti tionPool()的调用而被创建。不同分区的大小和数目用户可以通过修改配置文件xxxconst.h来进行控制。

（4）如同任务的堆栈的内存分配一样，队列内存的分配是通过os_CreateMemoryPool()而得到的，它的大小也可以通过调整xxxconst.h而进行改变。

（5）在xxxcomp.c中有一张包含了所有在应用程序中的实体的pei_create（）函数地址的表。实体可能以一个单独的任务运行也可能是共享一个任务。框架调用每一个pei_create函数并根据该函数的参数而创建一个实体。

（6）调用os_CreateTask()而创建一个任务。

（7）当所有任务都被创建后，框架像创建他们一样也使用相同的启动命令来启动他们。在进一步的初始化（如L1层和他的驱动）后，Application_Initialize()将会返回，内核中的调度将会被激活。

（8）任务根据他们的优先级不同而依次被调度。对于所有的任务来说，这里只有一个任务实体的函数。每个任务它都只被调用一次。每个任务都有它自己的堆栈空间和处理由所有框架函数通过pf_TaskEntry()发出的请求。

（9）在任务中每个实体函数消息队列通过os_CreateQueue()的调用而被创建。队列中实体的数量是通过pei_create()中输出的结构体而得知。

（10）pei_init()被调用。它的函数地址也是通过pei_create()中输出的结构体而得知。

（11）在pei_init()中当前被调度的实体同其他实体进行通信的通信通道被打开。这是通过调用vsi_c_open()来完成的。打开一个通信通道意味着向框架请求得到队列中的那些实体的句柄。如果一个实体的句柄因为相应的任务没有被调度而不能被请求，这时pei_init()将会返回一个错误信息，当前活动的任务将会被阻塞100ms以使内核能够调度比当前任务优先权低的任务。然后pei_init()将再次被调用。当所有被请求的句柄都被得到后，一个内部的数据库将通过pei_init()而被初始化。.

（12）如果与一个任务进行通信的所有的任务并没有都被调度，那么该任务可能被阻塞。

（13）如果一个任务在一个活动的主体中运行，pei_run将被调用。实体的主要循环也包含在pei_run()中。

（14）对于运行在被动活动主体中的任务其主要的循环已经进入了。任务将会进入os_ReceiveFromQueue()同时被阻塞直到它的消息队列接收到一个消息为止。

该项目平台是TI的locosto，ARM7处理器，nor boot，128+32
DM技术方案提供商为bitfone公司。

在没有加入DM方案以前，系统的划分如下

name            origin    length
———————-  ——–  ———  ——–  —-  ——–
BOOT_MEM                00000000   00100000
D_MEM0                  00400000   00300000
P_MEM0                  06000000   00210000
P_MEM1                  06210000   001f0000
P_MEM2                  06400000   00100000
P_MEM3                  06500000   00180000
R_MEM                   06680000   00380000
FFS_MEM                 06a00000   00600000
S_MEM                   08000000   00037560
S_MEM_JPEG_JUMPTABLE    0804fb60   00000250
S_MEM_JUMPTABLE         0804fdb0   00000250
S_ROM                   08050000   00030000

根据FOTA的实现原理，我们需要划分出Bootloader部分，存放差分包和FOTA标志部分，最后修改后的系统情况如下：
name            origin    length
———————-  ——–  ———  ——–  —-  ——–
BOOT_MEM                00000000   00100000
D_MEM0                  00400000   00300000
P_DMBOOT                06000000   00020000
P_MEM0                  06020000   00210000
P_MEM1                  06230000   001d0000
P_MEM2                  06400000   00030000
P_MEM3                  06430000   00370000
P_DMBIN                 067a0000   00060000
R_MEM                   06800000   00200000
FFS_MEM                 06a00000   00600000
S_MEM                   08000000   00037560
S_MEM_JPEG_JUMPTABLE    0804fb60   00000250
S_MEM_JUMPTABLE         0804fdb0   00000250
S_ROM                   08050000   00030000
FOTA需要的空间是以前空余的代码段，文件系统部分是没有改变的。FOTA的标志部分因为空间原因放在差分包的最后一个block中。
#define DM_FLAG_ADDR        (0×067a0000+0×60000-5)

#define DM_NEED_UPDATE_FLAG     (DM_FLAG_ADDR)
#define DM_REPORT_FLAG     (DM_NEED_UPDATE_FLAG+1)
#define DM_SUCCESSED_FLAG     (DM_REPORT_FLAG+1)
#define DM_VALIDATION_PHASE_FLAG     (DM_SUCCESSED_FLAG+1)
#define DM_UPDATE_PHASE_FLAG     (DM_VALIDATION_PHASE_FLAG+1)
Read the rest of this post »

直接通过一个例子来解释。
-c /* Autoinitialize variables at runtime */
在代码中可以使用scatter file中的符号。

以下这个MEMORY字段是这个系统的整体上划分。包括系统的flash，片外ram，片内ram，还有也表明了已经固化的ROM的地址及其长度。

MEMORY
{
/* Secure Boot ROM */
BOOT_MEM (RXI)  : org = 0×00000000   len = 0×00100000
名称（属性） 要固定的起始地址  长度。
/* CS0: External SRAM 2 Mbytes */
D_MEM0   (RW)  : org = 0×00400000   len = 0×002d0000

/* code Area */
P_MEM0   (RXI) : org = 0×06000000   len = 0×00210000
P_MEM1   (RXI) : org = 0×06210000   len = 0×001f0000
P_MEM2   (RXI) : org = 0×06400000   len = 0×00080000
P_MEM3   (RXI) : org = 0×06480000   len = 0×00180000

/* resource Area */
R_MEM      (RXI)  : org = 0×06600000   len = 0×00200000

/* FFS Area  */
FFS_MEM  (RI)  : org = 0×06800000   len = 0×00800000

S_ROM   (RXI) : org = 0×08050000   len = 0×00030000

/* Allocate memory for MIDI and JPEG */

/* CS6: Calypso+ Internal SRAM 320 kbytes */
/* Code & Variables Memory */
S_MEM    (RXW) : org = 0×08000000   len = 0×00037560 /*0×0004FB60*/
}

-heap 0×10000    /*HEAP AREA SIZE*/
Heap是留给系统实时库使用的空间。

SECTIONS字段是对MEMORY中各个段的详细描述。

SECTIONS
{
/* Entry point of the Firmware */
.start   : {} > 0×06000000
.start是使用预处理指定定义的一个标识，代码中是
.sect “.start”
这里将其地址固定在0×06000000处。
/*
*  Interrupt vector re-mapping management
*/
.intload : {} > 0×06000004
.indint  : {} load = 0×06000008, run = 0×0800000C
.indint的代码储存在flash中的地址也就是load的地址是0×06000008，但是可以通过run = 0×0800000C来实现其在ram运行，在ram中的地址是0×0800000C，链接器在link时对该处使用在ram中的地址来进行链接。

.inttext : {} > P_MEM0     /* int.s Code */

.bss_dar : > D_MEM0        /* DAR SWE Variables */
{
$(BSS_DAR_LIB)
}
名称为BSS_DAR_LIB的lib的bss，也就是全局变量放入到D_MEM0，而且他们有一个标识.bss_dar
.bss     : > D_MEM0        /* Global & Static Variables */
{
$(BSS_BOOT_LIB)
}
.bss是编译器默认的全局变量的名称。以上一段是将名称为BSS_BOOT_LIB的lib中的全局变量放入到D_MEM0中。
Read the rest of this post »

典型的手机ic由以下几部分组成
The Digital Base Band structure
The Radio Frequency Sub-System
The RF Sub-System Wrapper

这部分主要由MCU部分，DSP部分，外设GPIO，数据总线等部分组成。

Read the rest of this post »

一般我们看到的m0，SHX文件格式都是摩托罗拉文件格式，TI编译系统最后生成的m0文件也就是摩托罗拉文件格式。
其相关资料如下：
The Motorola S-record format is an ASCII encoding for binary data. It is also known as the SREC or S19 format.
An SREC format file consists of a series of ASCII records. All hexadecimal (hex) numbers are Big Endian.
The records have the following structure:

1. Start code, one character, an S.
2. Record type, one digit, 0 to 9, defining the type of the data field.
3. Byte count, two hex digits, indicating the number of bytes (hex digit pairs) that follow in the rest of the record (in the address, data and checksum fields).
4. Address, four, six, or eight hex digits as determined by the record type for the memory location of the first data byte.
5. Data, a sequence of 2n hex digits, for n bytes of the data.
6. Checksum, two hex digits - the one’s complement of the least significant byte sum of the values represented by the two hex digit pairs for the byte count, address and data fields.

There are eight record types, listed below:

The S0 record data sequence contains vendor specific data rather than program data. The record count in the S5 record is stored in the 2-byte address field. The address field of the S7, S8, or S9 records may contain a starting address for the program.

S00F000068656C6C6F202020202000003C
S11F00007C0802A6900100049421FFF07C6C1B787C8C23783C6000003863000026

S11F001C4BFFFFE5398000007D83637880010014382100107C0803A64E800020E9
S111003848656C6C6F20776F726C642E0A0042
S5030003F9

S9030000FC

Start code Record type Byte count Address Data Checksum