Qualcomm Modem Configuration w/ Carrier Policy (XML)
For the past week, I've been using OnePlus 8 Pro and there's a fair bit to talk about with using it in South Korea. In general, the experience was positive but there was a critical issue with 4G compatibility: Most of the smartphones which are imported do not officially support LG Uplus network in South Korea because The LTE bands Uplus uses are B1(2100), B5(850 for main), B7(2600), which are not commonly used in global, and Uplus in Korea does not have commonly used 3G service network such as WCDMA and HSPA. The problem is in here. The other carriers like SKT and KT officially support WCDMA and HSPA for a circuit-switched fallback (CSFB), but Uplus DOES NOT have support for them, these were the reason behind lack of support of iPhones before 5 in the Uplus carrier. Fortunately, by utilizing IMS-based technologies like SMS over IP and VoLTE(Voice over LTE), Uplus was able to support a lot of smartphones including iPhones.
But the problem has not been solved yet for the smartphones imported, even though these days more and more smartphones are supporting almost all the whole LTE bands, those smartphones can use LTE capabilities but have some problems like many users are suffering frequently dropping calls, and losing signals. Me too of course I have suffered the same issues, going into this, I'd like to learn how cellular network works and Qualcomm modems handle the signal and then deal with these issues.
Fortunately there was a community dealing with this issues in South Korea: ๋ฆฌํผ๋น์ฌํฉํ ๋ฆฌ(RefurbishFacotry). There was a lot of information by those people needing VoLTE support, I've got many pieces of information from there, and by inspecting Qualcomm MBN(Modem Configuration Binaries) files I managed to know what configurations are in there and how configurations are applied to the device modem. This work was so easy because the extracted files itself have a semantic path such as 'IMS', 'Profile', and 'Mandatory'. So from here, I figured out what was causing the connectivity issues in the Uplus cellular network.
Korea's LTE/5G network
- SKTelecom (aka. SKT or SK): LTE-FDD Band 1(2100, sub-op freq.), 3(1800, sub-op freq.), 5(850, main-op freq.), 7(2600, sub-op freq.), NR-TDD Band 78(3500, sub-6GHz), and 28GHz mmWave.
- Korea Telecom (aka. KT): LTE-FDD Band 1(2100, sub-op freq.), 3(1800, have two of freqs, both are sub and main.), 8(900, sub-op freq.), 26(800, narrowband and not installed.), NR-TDD Band 78(3500, sub-6GHz), and 28GHz mmWave.
- LG Uplus (aka. LG or Uplus): LTE-FDD Band 1(2100, sub-op freq.), 5(850, main-op freq.), 7(2600, sub-op freq.), NR-TDD Band 78(3500, sub-6GHz), and 28GHz mmWave.
As you can see, both SK and KT have similar radio frequency but Uplus does not. In order to set the preferred network bands in Qualcomm modem, I had to modify the carrier_policy.xml file, which is a part of Qualcomm MBN.
Carrier Policy
First of all, the carrier policy file is a XML-based policy definition file, and has the following structure:
- policy: define such name and version of the policy
- policy.initial: initial setup. most of configs are defined in here as well.
- policy.initial.actions: action definitions.
- mcc_list: MCC(Mobile Country Code) definition. South Korea have 450.
- plmn_list: PLMN(Public Landing Mobile Network) consists of both MCC and MNC(Mobile Network Code). Simply put, PLMN means a service carrier.
- rf_band_list: RF(Radio Frequency) Band List. This is the necessary part of the carrier policy.
- feature
- rat_capability: RAT(Radio Access Technology). Easily said, the standard technologies by 3GPP such as GSM, WCDMA, LTE, and NR.
The file comes with the following tree:
<policy name = "generic"
changelist = "$Change: 20170111 $"
schema_ver = "1"
policy_ver = "450.1.21"
>
<initial>
<actions>
<mcc_list name="home_mccs">450</mcc_list>
<plmn_list name="SKT_KT">450-08 450-05 450-02</plmn_list>
<plmn_list name="uplus">450-06</plmn_list>
<!-- Uplus RF Band list -->
<rf_band_list name="uplus_rf_bands">
<gw_bands base="none" />
<lte_bands base="none" >
<include> 0 4 6 </include>
</lte_bands>
<tds_bands base="none" />
</rf_band_list>
<!-- SKT KT RF Band list -->
<rf_band_list name="SKT_KT_rf_bands">
<gw_bands base="none">
<include>0 1 22</include>
</gw_bands>
<lte_bands base="none">
<include>0 2 4 6 7</include>
</lte_bands>
<tds_bands base="hardware" />
</rf_band_list>
</actions>
</initial>
</policy>Because it's common to use zero-based numbering in computers, it makes sense this config also has the same rule. In this case, LTE bands 1 5 7 (uplus) are mapped into 0 4 6. Yup, it's nothing special here, right?
Conditions
<!-- RULE #1 -->
<!-- We wait if we don't have location or we are not ONLINE.
-->
<if precond="none">
<cond>
<phone_operating_mode> ONLINE </phone_operating_mode>
<have_location />
</cond>
<then>
<svc_mode> FULL </svc_mode>
<continue />
</then>
<else />
</if>Conditions are defined with 'if' and 'cond' blocks. The first condition is simply the requirement that the operating mode is set to ONLINE, and have the current PLMN data set, which commonly means the SIM card is properly inserted. Let's take a look. If these conditions are met, service mode must be set to FULL, and continue to find the next conditions for configuring up the modem. So let's look at some more conditions:
<!-- RULE #2 -->
<!-- If Uplus, set uplus KR bands
-->
<if>
<cond>
<location_mcc_in list="home_mccs" />
<serving_plmn_in list="uplus" />
</cond>
<then>
<rat_capability base="none">
<include> L 5G </include>
</rat_capability>
<rf_bands list="uplus_rf_bands" />
</then>
<else>
<rat_capability base="none">
<include> GSM WCDMA LTE </include>
</rat_capability>
<rf_bands />
</else>
</if>
<!-- RULE #3 -->
<!-- If SKT or KT, set SKT KR bands -->
<if>
<cond>
<location_mcc_in list="home_mccs" />
<serving_plmn_in list="SKT_KT" />
</cond>
<then>
<rat_capability base="none">
<include> G W L 5G </include>
</rat_capability>
<rf_bands list="SKT_KT_rf_bands" />
</then>
</if>This is so simple to read, right? As I said in the beginning, RAT means Radio Access Technology, and Uplus does not support 3G (including HSPA+) capabilities. So it was worth thinking the connectivity issue happens here when the device tries to connect to 3G network if it's defined even thought it won't work. I had to remove the other capabilities except for 4G and 5G caps, and, as a result, there are only two caps left: L(LTE) and 5G. I think the other kinds of stuff are easy to understand, rf_bands is just a thing that we've seen before in the initial configuration list and therefore uplus_rf_bands will be used and operated in either LTE or 5G mode if a uplus sim card is inserted.
I guess there's nothing special to describe more about carrier policy. Carrier policy is just how the modem works for the carrier, and, as far as I can see, this file is compatible between all smartphones that use Qualcomm modem. Hence I'm trying to make a profile that supports Uplus bands as well as all LTE/NR bands worldwide.
Next important part: VoLTE
Caveat: I don't even know how the VoLTE REALLY works, this section is written down by the guess.
VoLTE is a technology where we can simultaneously send voice and data over the network without reducing the quality of voice by placing a call over the existing 4G connection rather than using common voice calling networks. The keyword of the VoLTE technology is 'IMS', which means IP Multimedia Subsystem. Because LTE relies on IP techniques although VoLTE is a 'voice' service, VoLTE is implemented on the top of the data network using SIP(Session Initiation Protocol) and utilizing IMS technology.
Since Uplus network is designed to utilize the full bandwidth for every use, they've implemented all kinds of mandatory things such as call, SMS, etc on the data network. The call works with the AMR-WB(Adaptive Multi-Rate Wideband) codec, and the SMS works with SMS over IP using the SIP server 'ipsmgw.lte-lguplus.co.kr'. And there are several files to set these up, which are located in nv/item_files/ims in the EFS partition:
- ims_operation_mode
- ims_sip_config: SIP call configuration
- ims_user_agent: used to inform the IMS server which user-agent device is.
- IMSCodecDynamicConfig
- IMSRTPDynamicConfig (RTP means Realtime Transport Protocol, I think this is the most important config for all IMS features.)
- IMSVoiceDynamicConfig (VoLTE)
- IMSWifiDynamicConfig (VoWiFi)
- SMSConfiguartion (I checked that this defines which SMS SIP server to use.)
- SMSoIP_UsagePolicy
- qp_ims_*
These are all configs that I have checked and required to use VoLTE. So far I've checked there is no way to set these configs manually, instead, you have to find the right files for your carrier in other smartphones that are officially released in your country.
More configs that are worth to see
- nv/item_files/modem/mmode/sms_mandatory: As the name implies, LTE will be blocked and fallback to 2G or 3G network when IMS SMS service registration failed. So it's recommended to disable this config.
- nv/item_files/modem/lte/rrc/cap/disable_cap_ies: This disables QAM 64/256 capabilities so CA(Carrier Aggregation) won't work when this file exists and set to true.
Do not forget to append 'ims' to your APN setting
Conclusion
No flaws that I can see so far.
I'm very happy with the result after the work. It seems the signal lost issue has been solved, and even this works with Dual-SIM stand-by. Of course, carrier aggregation with the all supported LTE bands works perfectly:
About stability
I've been using this configuration for about 3 -day with no problem, but I can't be sure to get a stable connection for more days.
I never thought I could solve the issue that is widely known: Uplus won't work stable when you use an imported smartphones like from China โ Xiaomi in the example at the top.
Of course, it remains to be seen whether this will continue to work stable. I'll keep this post updated and share the policy file that I've used for my OnePlus 8P.
Here is the carrier_policy.xml file I've modified:
