Getting frequency band in use

[Bjørn Mork]

Aleksander Morgado <aleksander at aleksander.es> writes:

> Isn't that QMI_NAS_GET_CELL_LOCATION_INFO (0x0043). I think I already
> tried to add it once to libqmi, but got bored because the TLVs were
> too long :)

Yes, that is the one.  Not only are they long, but they also contain a
mix of values and variable length arrays of structs.  It's one of the
ugliest messages I've seen.  But it's also one of the most useful.

I've had a some of my hackish perl around for a while for my own use,
implementing just the basic parts I was interested in.  Now that I can
get the docs from an open source, I can probably also use that for
illustrating


On LTE, but not connected (or connected but not currently active), you
see

  TLV 0x13 - sNASGetCellLocationInfoResponse_IntrafrequencyLTEInfo:
     the current serving cell
  TLV 0x14 - sNASGetCellLocationInfoResponse_InterfrequencyLTEInfo:
     other LTE frequencies in the same network
  TLV 0x15 - sNASGetCellLocationInfoResponse_LTEInfoNeighboringGSM:
     GSM neighbouring cells in the same network
  TLV 0x16 - sNASGetCellLocationInfoResponse_LTEInfoNeighboringWCDMA
     UMTS frequencies in the same network


[Tue Apr 29 12:49:09 2014] read 87 bytes from /dev/cdc-wdm0
01 56 00 80 03 05 02 02 00 43 00 4a 00 02 04 00 00 00 00 00 16 0a 00 01 01 f1 29 03 00 00 08 00 00 15 02 00 01 00 14 0e 00 01 02 aa 05 00 0c 06 00 00 19 00 10 05 00 13 1d 00 01 42 f2 10 e1 79 00 b2 03 01 ea 0b 1d 01 07 0a 08 3a 01 1d 01 af ff 1d fc 39 fd 1c 00 
<= QMUX Header:
<=   len:    0x0056
<=   sender: 0x80
<=   svc:    0x03
<=   cid:    0x05

<= QMI Header:
<=   Flags:  0x02
<=   TXN:    0x0002
<=   Cmd:    0x0043
<=   Size:   0x004a
<= [0x02] ( 4) 00 00 00 00      SUCCESS - QMI_ERR_NONE
<= [0x13] (29) 01 42 f2 10 e1 79 00 b2 03 01 ea 0b 1d 01 07 0a 08 3a 01 1d 01 af ff 1d fc 39 fd 1c 00 
        idle, tac=0x79e1, global_cell=0x0103b200, earfcn=3050, serving_cell=285, 7/10/8/58
                 285: rsrq=-8 dB, rsrp=-99 dBm, rssi=-71 dBm srxlev=28
<= [0x14] (14) 01 02 aa 05 00 0c 06 00 00 19 00 10 05 00 
        idle, earfcn=1450, 0/12/6
        idle, earfcn=6400, 0/16/5
<= [0x15] ( 2) 01 00    ..
<= [0x16] (10) 01 01 f1 29 03 00 00 08 00 00 
        idle, uarfcn=10737, 8/0/3


So you can see that I am currently on LTE B7 (2600 MHz, channel 3050),
and have two other LTE bands available: B3 (1800 MHz, channel 1450) and
B20 (800 Mz, channel 6400).  There are no GSM neighbouring cells, which
probably is not really correct but who cares...  And then there is an
UTRA band 1 (2100 MHz, channel 10737)

If I connect and keep sending traffic over the link, then I don't get
any data about other frequencies, but instead I get a list of
neigbouring cells on the current frequency:


[Tue Apr 29 13:06:04 2014] read 97 bytes from /dev/cdc-wdm0
01 60 00 80 03 07 02 02 00 43 00 54 00 02 04 00 00 00 00 00 16 02 00 00 00 15 02 00 00 00 14 02 00 00 00 13 3b 00 00 42 f2 10 e1 79 00 b2 03 01 ea 0b 1d 01 00 00 00 00 04 1d 01 e0 ff 10 fc f7 fc 00 00 13 00 54 ff 64 fb f5 fc 00 00 3a 00 4e ff 85 fb fe fc 00 00 39 00 c8 fe 05 fb f0 fc 00 00 
<= QMUX Header:
<=   len:    0x0060
<=   sender: 0x80
<=   svc:    0x03
<=   cid:    0x07

<= QMI Header:
<=   Flags:  0x02
<=   TXN:    0x0002
<=   Cmd:    0x0043
<=   Size:   0x0054
<= [0x02] ( 4) 00 00 00 00      SUCCESS - QMI_ERR_NONE
<= [0x13] (59) 00 42 f2 10 e1 79 00 b2 03 01 ea 0b 1d 01 00 00 00 00 04 1d 01 e0 ff 10 fc f7 fc 00 00 13 00 54 ff 64 fb f5 fc 00 00 3a 00 4e ff 85 fb fe fc 00 00 39 00 c8 fe 05 fb f0 fc 00 00 
        !idle, tac=0x79e1, global_cell=0x0103b200, earfcn=3050, serving_cell=285, 0/0/0/0
                 285: rsrq=-3 dB, rsrp=-100 dBm, rssi=-77 dBm srxlev=0
                  19: rsrq=-17 dB, rsrp=-118 dBm, rssi=-77 dBm srxlev=0
                  58: rsrq=-17 dB, rsrp=-114 dBm, rssi=-77 dBm srxlev=0
                  57: rsrq=-31 dB, rsrp=-127 dBm, rssi=-78 dBm srxlev=0
<= [0x14] ( 2) 00 00    ..
<= [0x15] ( 2) 00 00    ..
<= [0x16] ( 2) 00 00    ..



Bjørn