[Xiaomi Mi Note Pro] Aqq123:
Bonus: Qualcomm NVRAM Settings & 2G/3G/4G LTE Band Config

A lot has been written about this topic but the relevant bits are scattered and there is a lot of misunderstanding. My goal here is to provide a summary of all the relevant information as it relates to this device. As in the place where I am at the moment there are no networks operating on any of the extra bands I attempted to enable, I can't confirm if I managed to do so. Still, there is probably no harm in trying, as long as you know what you're doing, and how to undo any changes.

Choosing Bands to Enable

Before we start, it's best to figure out what exactly we're trying to do, in terms of the desired result.

Factory-Enabled Bands

First of all, these are the bands that are already supported. It's important to start from this because there are people claiming they "unlocked" some of them. Well, they didn't, really; they were already enabled. This situation is aggravated by the lack of any way to list all the operational bands on the phone (if you know of a way to do so, please share!).

The information below comes from Xiaomi's website but I expanded it to include other common designations for bands, along with the frequencies and a general indication of the world region they are used in:

4G

FDD-LTE

1 (2100 MHz; Europe & Asia Misc)

3 (1800 MHz; Europe & Asia)

7 (2600 MHz; Europe & Asia)

TDD-LTE

38 (2600 MHz; Europe Misc)

39 (1900 MHz; China)

40 (2300 MHz; China, Asia Misc)

41 (2500 MHz; China)

3G

TD-SCDMA

34 / A (2010-2025 MHz; China)

39 / F (1880-1920 MHz; China)

WCDMA

1 / I (2100 MHz; Europe & Asia)

2 / II (1900 MHz; US: AT&T, T-Mobile)

5 / V (850 MHz; US: AT&T)

8 / VIII (900 MHz; Europe & Asia)

CDMA2000

BC0 (800 MHz)

BC1 (1900 MHz)

2G

GSM/CDMA1X

2 (1900 MHz; Americas)

3 (1800 MHz; Europe & Asia)

5 (850 MHz; Americas)

8 (900 MHz; Europe & Asia)

BC0 (800 MHz)

BC1 (1900 MHz)

The above list is for Xiaomi Note Pro 2015022 (All-Network) version. Some versions do not support CDMA1X and CDMA2000.

Irrelevant Bands

On the other hand, for a multitude of reasons, the following LTE bands enjoy very limited use or are not used at all or even allocated, so enabling them would not really change anything for anyone (this is somewhat arbitrary, people located in Japan might disagree to some extent): 6, 9-11, 13-16, 18, 19, 21-27, 29-37, 42-44

Potentially Interesting Bands

The above investigation leaves us with a list of bands that would be potentially interesting to enable. Classifying them by the region:

Europe: 4G FDD LTE Band 20 (800 MHz)

Asia: 4G FDD LTE Bands 5 (850 MHz, also US regional), 8 (900 MHz) and 28 (700 MHz)

America:

3G UMTS Band 4 (1700 MHz, T-Mobile)

4G FDD LTE Bands 2 (1900 MHz), 4 (1700 MHz), 12 (700 MHz, T-Mobile), 17 (700 MHz, AT&T)

Wikipedia has more information on: LTE bands, LTE network list, LTE network list in Europe, UMTS bands, UMTS network list.

Enabling the Extra Bands

Now that we know what we're trying to enable, here's how.

Qualcomm Diagnostics Setup

Connect the phone to computer with USB cable.

On Windows 8.1, boot the computer into the Disable Driver Signature Enforcement mode.

On the phone keypad type *#*#717717#*#* to enable the diagnostics mode.

Open the Device Manager (Win+X, M).

Locate the device with Vendor ID: 05C6 and Product ID: 9025, where the instance path contains MI_00 (USB\VID_05C6&PID_9025&MI_00\...) and force the installation of the Qualcomm HS-USB Diagnostics 9025 driver onto it.

Both the driver version 2.0.8.1 from some Sony phone, which can be found in many places on the Internet, and the driver version 2.1.0.5 included with the official Xiaomi drivers seem to work for me. If you have problems installing the driver, you can also try editing the *.inf files and changing "NTia64" and "NTamd64" to "NTia64.6.3" and "NTamd64.6.3" respectively. You then also need to delete the accompanying *.cat files as their signatures will no longer match.

To edit the NVRAM settings I used the following Qualcomm software versions:

Qualcomm Product Support Tools (QPST) 2.7.411

Qualcomm Extensible Diagnostic Monitor (QXDM) 3.12.714

Other versions will probably work just as fine. Open QPST Configuration first. Make sure there is an active phone there, and leave it running. Then, open QXDM as well and in Options → Communications check the box next to the matching device and

choose the matching COM port

from the pull-down list below. Click OK and choose the NV Browser view. To paraphrase MIUI, you're ready to rock!

NVRAM Values

These are the changes I have made to enable all the "potentially interesting" bands listed above:

ID	Desc	Original Value	Modified Value
01877	rf_bc_config	562950035735431	562950069289863
00441	band_pref	0xFFFF	0xFFFF (Same)
00946	band_pref_16_31	0xBFFF	0xBFFF (Same)
02954	band_pref_32_63	131072	131072 (Same)
06828	lte_bc_config	2061584302149	2061719111903

If you want to know why the above numbers are what they are, read on. Otherwise, feel free to try the above settings.

Understanding the Values

Generally these numbers are just a series of binary flags. You can think of them as a large congregation of on/off switches, next to one another, each corresponding to a particular, specific band. Thus, to see what's going on and make our changes, we convert them to the binary representation. After we're done, we convert them back to the form that is acceptable as input by QXDM (which is decimal again, for the particular registers we're modifying).

2G & 3G Configuration

The 2G and 3G configuration is determined by four values. First, take the three band_pref* values:

band_pref [= band_pref_0_15] (16-bit):
0xFFFF	1111111111111111

band_pref_16_31 (16-bit):
0xBFFF	1011111111111111

band_pref_32_63 (32-bit):
000131072	00000000000000100000000000000000

The three are juxtaposed to form a 64-bit quad-word (the split is probably to maintain some compatibility with legacy architectures, there is no logical reason for this). Then, the result of bitwise conjunction of rf_bc_config (configured bands), also a 64-bit quad-word, and the three juxtaposed band_pref* values (preferred bands) determine which bands are available.

rf_bc_config (64-bit):
0000562950035735431	0000000000000010000000000000000000000100111010000000001110000111
0000562950069289863	0000000000000010000000000000000000000110111010000000001110000111
0000000000000010000000000000000010111111111111111111111111111111
band_pref_32_63 band_pref_16_31 band_pref_0_15

The difference between the two values is apparently that rf_bc_config are the pre-configured bands, whereas the band_pref values can be modified at run-time, for example through the *#*#INFO#*#* (or *#*#4636#*#*) menu.

For our purposes, we notice that we need a band to be both "configured" and "preferred" to be available, which means the corresponding bit should be a 1 in each of the above values.

The meaning of the particular bits is as such (note that they are counted from right to left, that is bit 0 is the rightmost bit):

Def Chngd
Bit Cf Pr Cf Pr Description
#00 1 1 . . CDMA Band Class 0: A-System US Cellular (800MHz)
#01 1 1 . . CDMA Band Class 0: B-System
#02 1 1 . . CDMA Band Class 1: All Blocks US PCS (1800-2000 MHz)
#03 0 1 . . CDMA Band Class 2: Placeholder TACS Band (872-960 MHz)
#04 0 1 . . CDMA Band Class 3: A-System Japan Cellular JTACS Band (832-925 MHz)
#05 0 1 . . CDMA Band Class 4: All Blocks Korean PCS Band (1750-1870 MHz)
#06 0 1 . . CDMA Band Class 5: All Blocks NMT Band (450 MHz)
#07 1 1 . . GSM DCS 1800 Band Europe (1800 MHz)
#08 1 1 . . GSM Extended (E-GSM) Band, Includes RF Band 9 GSM (900 MHz)
#09 1 1 . . GSM Primary (P-GSM) Band Europe (900 MHz)
#10 0 1 . . CDMA Band Class 6 IMT-2000 (2000 MHz)
#11 0 1 . . CDMA Band Class 7 (Upper 700 MHz)
#12 0 1 . . CDMA Band Class 8 (1800 MHz)
#13 0 1 . . CDMA Band Class 9 (900 MHz)
#14 0 1 . . CDMA Band Class 10 (Secondary 800 MHz)
#15 0 1 . . CDMA Band Class 11 European PAMR (400 MHz)
#16 0 1 . . <Unused> GSM 450 Rural Parts
#17 0 1 . . <Unused> GSM 480
#18 0 1 . . <Unused> GSM 750
#19 1 1 . . GSM Band US (850 MHz)
#20 0 1 . . RGSM GSM Railways, Includes RF Bands 8 & 9 (900 MHz)
#21 1 1 . . GSM PCS 1900 Band US (1900 MHz)
#22 1 1 . . WCDMA Band I - Europe, Asia (Japan), New Zealand (2100 MHz)
#23 1 1 . . WCDMA Band II - PCS North America (1900 MHz)
#24 0 1 . . WCDMA Band III - DCS Europe, Asia (1800 MHz)
#25 0 1 1 . WCDMA Band IV - US T-Mobile (AWS) (1700 MHz)
#26 1 1 . . WCDMA Band V - North America, Australia, New Zealand, Philippines (850 MHz)
#27 0 1 . . WCDMA Band VI - Japan (800 MHz)
#28 0 1 . . CDMA Band Class 12 PAMR (800 MHz)
#29 0 1 . . CDMA Band Class 14 US PCS (1900 MHz)
#30 0 0 . . <Reserved>
#31 0 1 . . CDMA Band Class 15 Advanced Wireless Services (AWS)
#32 0 0 . . <Reserved> WLAN US (2400 MHz)
#33 0 0 . . <Reserved> WLAN ETSI (2400 MHz)
#34 0 0 . . <Reserved> WLAN FR (2400 MHz)
#35 0 0 . . <Reserved> WLAN ES (2400 MHz)
#36 0 0 . . <Reserved> WLAN JP (2400 MHz)
#37 0 0 . . <Reserved> WLAN US (5000 MHz)
#38 0 0 . . <Reserved> WLAN EU (5000 MHz)
#39 0 0 . . <Reserved> WLAN FR (5000 MHz)
#40 0 0 . . <Reserved> WLAN ES (5000 MHz)
#41 0 0 . . <Reserved> WLAN JP (5000 MHz)
#42 0 0 . . <Reserved>
#43 0 0 . . <Reserved>
#44 0 0 . . <Reserved>
#45 0 0 . . <Reserved>
#46 0 0 . . <Reserved>
#47 0 0 . . <Reserved>
#48 0 0 . . WCDMA Band VII - Europe (2600 MHz)
#49 1 1 . . WCDMA Band VIII - Europe, Asia, Australia, New Zealand (900 MHz)
#50 0 0 . . WDCMA Band IX - Japan (1700 MHz)
#51 0 0 . . AWS+ Band X US (1700 MHz)
#52 0 0 . . 1500 Band XI Japan (1500 MHz)
#53 0 0 . . 700ac Band XII USA
#54 0 0 . . 700 C Band XIII USA
#55 0 0 . . 700PS Band XIV USA
#56 0 0 . . CDMA Band Class 16 US (2500 MHz)
#57 0 0 . . <Reserved>
#58 0 0 . . <Reserved>
#59 0 0 . . <Reserved>
#60 0 0 . . WCDMA Japan (800 MHz)
#61 0 0 . . <Reserved>
#62 0 0 . . <Reserved>
#63 0 0 . . <Reserved>

Some of the bands listed above are purely theoretical, as they have never been used. From the above breakdown, it's quite obvious that to enable WCDMA Band IV, which is what I'm after here, it's enough to toggle just one bit, and the band_pref* values do not need to be modified at all.

4G LTE Configuration

The LTE configuration settings are much simpler, controlled by just a single variable, lte_bc_config. The variable is a quad-word (64-bit) again but only the first 44 bits appear to be relevant. Each bit corresponds to a single LTE band, starting with the rightmost bit being responsible for band 1. Overall:

lte_bc_config (64-bit, of which 44 bits relevant):	Bands Active:
2061584302149	00011110000000000000000000000000000001000101	1.3...7. 38-41
2061719111903	00011110000000001000000010010000100011011111	12345.78 12 17 20 28 38-41
2061584892127	00011110000000000000000010010000000011011111	12345.78 17 20 38-41

You can then see that the modified value enables LTE bands 2, 4, 5, 8, 12, 17, 20, 28 in addition to the ones that were already enabled. (Whether it works is another story, as I said I'm unable to verify it at the moment.)

The third line is what is necessary to enable LTE bands 2, 4, 5, 8, 17, 20, while not trying to enable bands 12 and 28, which are unlikely to work due to the lack of hardware support.