Understanding the 0xB826 and HW combos in Qualcomm Modem-RF baseband firmware

Goal: obtain ueCapabilityInformation RRC packet information to corroborate the contents of the 0xB826 Qualcomm Diagnostic packet content obtained via the modem diagnostic interface (diag_mdlog).

Introduction:

Qualcomm modems broadcast a packet called 0xB826 which contains NR-CA combos defined by the modem firmware. Said combos cannot be changed after compile time as they are defined in the .c,.cpp source of the modem firmware and is proprietary. However, the HW combos can be limited or ‘pruned’ by the OEM via NV item files i.e. cap_prune (Samsung only, reduces specific combos), cap_control_nrca_f_plus_t_band_combos (disables or enables FDD + TDD combos entirely). Specific bands (and hence all of their combos) can also be limited by excluding them from the policy files hardware_band_filtering.xml or carrier_policy.xml in the EFS.

Commercial support by a UE for NR-CA combos therefore can only confirmed by the contents of the ueCapabilityInformation RRC packet reponse to the network (defined in the 3GPP Rel-15 & 16 standards), and not soley on the content of the 0xB826 packet. The OEM may have chosen to limit or reduce the available NR-CA combinations (often per the carriers’ request). The information element we’re looking for is in the ueCapabilityInformation RRC packet and is called the BandCombinationList information element; which contains a list of NR-CA and/or MR-DC band combinations. Not all commercially available UEs have NR-CA enabled. While the 0xB826 packet tells us which combinations are supported by the HW, obtaining the BandCombinationList tells us which combinations are supported in SW.