EM7565 / carrier aggregation info

Bjørn Mork bjorn at mork.no
Mon Dec 4 09:44:32 UTC 2017


Sebastian Sjoholm <sebastian.sjoholm at gmail.com> writes:

> Hi,
>
> Here is CA info with verbose qmi printout (both active and not active),
> prepare for a rather long post.

Thanks! Very useful.  Next request:  Are you cable to get a dump with
more than one secondary cell active/configured?


> *** TELIT LM940
..
> [04 Dec 2017, 06:37:24] [Debug] [/dev/cdc-wdm0] received generic response
> (translated)...
> <<<<<< QMUX:
> <<<<<<   length  = 71
> <<<<<<   flags   = 0x80
> <<<<<<   service = "nas"
> <<<<<<   client  = 3
> <<<<<< QMI:
> <<<<<<   flags       = "response"
> <<<<<<   transaction = 1
> <<<<<<   tlv_length  = 59
> <<<<<<   message     = "Get LTE Cphy CA Info" (0x00AC)
> <<<<<< TLV:
> <<<<<<   type       = "Result" (0x02)
> <<<<<<   length     = 4
> <<<<<<   value      = 00:00:00:00
> <<<<<<   translated = SUCCESS
> <<<<<< TLV:
> <<<<<<   type   = 0x10
> <<<<<<   length = 8
> <<<<<<   value  = 04:00:86:0B:00:00:00:00
> <<<<<< TLV:
> <<<<<<   type       = "DL Bandwidth" (0x11)
> <<<<<<   length     = 4
> <<<<<<   value      = 05:00:00:00
> <<<<<<   translated = 20
> <<<<<< TLV:
> <<<<<<   type       = "Phy CA Agg SCell Info" (0x12)
> <<<<<<   length     = 14
> <<<<<<   value      = 04:00:86:0B:05:00:00:00:7E:00:00:00:00:00
> <<<<<<   translated = [ physical_cell_id = '4' rx_channel = '2950'
> dl_bandwidth = '20' lte_band = 'eutran-7' state = 'deconfigured' ]
> <<<<<< TLV:
> <<<<<<   type       = "Phy CA Agg PCell Info" (0x13)
> <<<<<<   length     = 10
> <<<<<<   value      = 05:00:4C:0C:05:00:00:00:7E:00
> <<<<<<   translated = [ physical_cell_id = '5' rx_channel = '3148'
> dl_bandwidth = '20' lte_band = 'eutran-7' ]
> <<<<<< TLV:
> <<<<<<   type       = "SCell index" (0x14)
> <<<<<<   length     = 1
> <<<<<<   value      = 01
> <<<<<<   translated = 1

So this is pretty much the same as the EM7455 format, except for the TLV
0x10 which is new. But like the EM7455, the 'state' in 0x12 is pretty
much the only thing telling if CA is active or not.  Nothing else
changes between configured and active state, and there does not appear
to be any additional TLVs which would indicate support for more than one
secondary cell.

Not sure how to interpret this... This modem is also supposed to support
aggregation of more than two cells?


> *** SIERRA EM7565
> *************************************************************
>
> *** CA NOT ACTIVE ***
>
> # ./cmd.py -c raw,'at!gstatus?'; ./cmd.py -c raw,'AT!LTECA?'; qmicli -d
> /dev/cdc-wdm0 --nas-get-lte-cphy-ca-info; qmicli -d /dev/cdc-wdm0
> --nas-get-lte-cphy-ca-info -v
> at!gstatus?
> !GSTATUS:
> Current Time:  585142 Temperature: 27
> Reset Counter: 1 Mode:        ONLINE
> System mode:   LTE        PS state:    Attached
> LTE band:      B7      LTE bw:      20 MHz
> LTE Rx chan:   3148 LTE Tx chan: 21148
> LTE SSC1 state:NOT ASSIGNED
> LTE SSC2 state:NOT ASSIGNED
> LTE SSC3 state:NOT ASSIGNED
> LTE SSC4 state:NOT ASSIGNED
..
> [04 Dec 2017, 07:11:52] [Debug] [/dev/cdc-wdm0] received message...
> <<<<<< RAW:
> <<<<<<   length = 76
> <<<<<<   data   =
> 01:4B:00:80:03:01:02:01:00:AC:00:3F:00:02:04:00:00:00:00:00:10:08:00:05:00:4C:0C:00:00:00:00:11:04:00:FF:00:00:00:12:0E:00:00:00:00:00:FF:00:00:00:78:00:00:00:00:00:13:0A:00:05:00:4C:0C:05:00:00:00:7F:00:14:01:00:00:15:01:00:00
>
> [04 Dec 2017, 07:11:52] [Debug] [/dev/cdc-wdm0] received generic response
> (translated)...
> <<<<<< QMUX:
> <<<<<<   length  = 75
> <<<<<<   flags   = 0x80
> <<<<<<   service = "nas"
> <<<<<<   client  = 1
> <<<<<< QMI:
> <<<<<<   flags       = "response"
> <<<<<<   transaction = 1
> <<<<<<   tlv_length  = 63
> <<<<<<   message     = "Get LTE Cphy CA Info" (0x00AC)
> <<<<<< TLV:
> <<<<<<   type       = "Result" (0x02)
> <<<<<<   length     = 4
> <<<<<<   value      = 00:00:00:00
> <<<<<<   translated = SUCCESS
> <<<<<< TLV:
> <<<<<<   type   = 0x10
> <<<<<<   length = 8
> <<<<<<   value  = 05:00:4C:0C:00:00:00:00
> <<<<<< TLV:
> <<<<<<   type       = "DL Bandwidth" (0x11)
> <<<<<<   length     = 4
> <<<<<<   value      = FF:00:00:00
> <<<<<<   translated = unknown
> <<<<<< TLV:
> <<<<<<   type       = "Phy CA Agg SCell Info" (0x12)
> <<<<<<   length     = 14
> <<<<<<   value      = 00:00:00:00:FF:00:00:00:78:00:00:00:00:00
> <<<<<<   translated = [ physical_cell_id = '0' rx_channel = '0'
> dl_bandwidth = 'unknown' lte_band = 'eutran-1' state = 'deconfigured' ]
> <<<<<< TLV:
> <<<<<<   type       = "Phy CA Agg PCell Info" (0x13)
> <<<<<<   length     = 10
> <<<<<<   value      = 05:00:4C:0C:05:00:00:00:7F:00
> <<<<<<   translated = [ physical_cell_id = '5' rx_channel = '3148'
> dl_bandwidth = '20' lte_band = 'eutran-8' ]
> <<<<<< TLV:
> <<<<<<   type       = "SCell index" (0x14)
> <<<<<<   length     = 1
> <<<<<<   value      = 00
> <<<<<<   translated = 0
> <<<<<< TLV:
> <<<<<<   type   = 0x15
> <<<<<<   length = 1
> <<<<<<   value  = 00

The inactive state is similar to the LM940 and EM7455, but there are a
couple of possibly important differences:

- All TLVs related to secondary cell config (0x11, 0x12 and TLV 0x14)
  have invalid data, except for the 'state' value in TLV 0x12.
- there is a new 0x15 TLV not seen in any of the other modems


> *** CA ACTIVE ***
>
> # ./cmd.py -c raw,'at!gstatus?'; ./cmd.py -c raw,'AT!LTECA?'; qmicli -d
> /dev/cdc-wdm0 --nas-get-lte-cphy-ca-info; qmicli -d /dev/cdc-wdm0
> --nas-get-lte-cphy-ca-info -v
> at!gstatus?
> !GSTATUS:
> Current Time:  586285 Temperature: 30
> Reset Counter: 1 Mode:        ONLINE
> System mode:   LTE        PS state:    Attached
> LTE band:      B7      LTE bw:      20 MHz
> LTE Rx chan:   3148 LTE Tx chan: 21148
> LTE SSC1 state:ACTIVE      LTE SSC1 band: B7
> LTE SSC1 bw  : Unknown LTE SSC1 chan: 2950
> LTE SSC2 state:NOT ASSIGNED
> LTE SSC3 state:NOT ASSIGNED
> LTE SSC4 state:NOT ASSIGNED

OK, "only" one secondary.

> [04 Dec 2017, 07:30:57] [Debug] [/dev/cdc-wdm0] received message...
> <<<<<< RAW:
> <<<<<<   length = 91
> <<<<<<   data   =
> 01:5A:00:80:03:01:02:01:00:AC:00:4E:00:02:04:00:00:00:00:00:10:08:00:05:00:4C:0C:02:00:00:00:11:04:00:05:00:00:00:12:0E:00:04:00:86:0B:05:00:00:00:7F:00:02:00:00:00:13:0A:00:05:00:4C:0C:05:00:00:00:7F:00:14:01:00:01:15:10:00:01:04:00:86:0B:05:00:00:00:7F:00:02:00:00:00:01
>
> [04 Dec 2017, 07:30:57] [Debug] [/dev/cdc-wdm0] received generic response
> (translated)...
> <<<<<< QMUX:
> <<<<<<   length  = 90
> <<<<<<   flags   = 0x80
> <<<<<<   service = "nas"
> <<<<<<   client  = 1
> <<<<<< QMI:
> <<<<<<   flags       = "response"
> <<<<<<   transaction = 1
> <<<<<<   tlv_length  = 78
> <<<<<<   message     = "Get LTE Cphy CA Info" (0x00AC)
> <<<<<< TLV:
> <<<<<<   type       = "Result" (0x02)
> <<<<<<   length     = 4
> <<<<<<   value      = 00:00:00:00
> <<<<<<   translated = SUCCESS
> <<<<<< TLV:
> <<<<<<   type   = 0x10
> <<<<<<   length = 8
> <<<<<<   value  = 05:00:4C:0C:02:00:00:00
> <<<<<< TLV:
> <<<<<<   type       = "DL Bandwidth" (0x11)
> <<<<<<   length     = 4
> <<<<<<   value      = 05:00:00:00
> <<<<<<   translated = 20
> <<<<<< TLV:
> <<<<<<   type       = "Phy CA Agg SCell Info" (0x12)
> <<<<<<   length     = 14
> <<<<<<   value      = 04:00:86:0B:05:00:00:00:7F:00:02:00:00:00
> <<<<<<   translated = [ physical_cell_id = '4' rx_channel = '2950'
> dl_bandwidth = '20' lte_band = 'eutran-8' state = 'activated' ]
> <<<<<< TLV:
> <<<<<<   type       = "Phy CA Agg PCell Info" (0x13)
> <<<<<<   length     = 10
> <<<<<<   value      = 05:00:4C:0C:05:00:00:00:7F:00
> <<<<<<   translated = [ physical_cell_id = '5' rx_channel = '3148'
> dl_bandwidth = '20' lte_band = 'eutran-8' ]
> <<<<<< TLV:
> <<<<<<   type       = "SCell index" (0x14)
> <<<<<<   length     = 1
> <<<<<<   value      = 01
> <<<<<<   translated = 1
> <<<<<< TLV:
> <<<<<<   type   = 0x15
> <<<<<<   length = 16
> <<<<<<   value  = 01:04:00:86:0B:05:00:00:00:7F:00:02:00:00:00:01


So this is pretty similar to the other modems, except for the 0x15 TLV
which is extremely promising.  It changed from a single byte:

  00

in the inactive state to:

  01:04:00:86:0B:05:00:00:00:7F:00:02:00:00:00:01

with one active secondary.  Let's assume this is an array of active
secondaries, with a one byte array length followed by a 15 byte struct
for each active secondary.  The format of that struct appears to be the
same as the TLV 0x12 format followed by a one-byte value.  This value is
01 here, which coulød mean just about anything.  But I do note that it
matches the only interesting attribute left: The secondary cell index
(TLV 0x14 for the first of the secondaries).  AFAIK (or can guess :-),
this is an index into the table returned from --nas-get-cell-location-info


I think we have enough now to make the first guess: Information about
remaining secondaries will be available in the TLV 0x15 array.


Bjørn


More information about the libqmi-devel mailing list