yashsingh1/xdaforums huggingface dataset:
[Xiaomi Mi 5 Guides, News, & Discussion] pakidermo5000:
Well, the good thing is that there is a limited choice within the RF360, so it should be rather easy to find a phone with similar components.

LG G5 is not the best example, we know. But look at OP3:

Hardware for mi5 (see http://www.myfixguide.com/manual/xiaomi-mi5-teardown/)

POWER Management IC: Qualcomm PMI8994

POWER Management IC: Qualcomm PM8996

Skyworks PAM 77646-51

QFE1100 (freq independent)

LG G5

Power management ①: Qualcomm PMI 8996

Power management ②: Qualcomm PM 8996

Multiband Amplifier: Avago ACPM-7788

LTE reception: Skyworks 77440-11

Samsung S7 Edge

RF receiver: SkyWorks SKY78042

PMI: Qualcomm PM8996

Oneplus 3 (found here http://www.slashgear.com/oneplus-3-teardown-part-ii-whats-inside-28446199/)

The QFE3100 7R54947 HE603 00AVV0 you see here first is the Qualcomm QFE3100 Envelope Tracker, same as you’ll find in the Samsung Galaxy S7.

Qualcomm PMI 8996

Qualcomm WTR3925 RF Transceiver chip

Skyworks 77824-11 here, Power Amplifier Module For FDD LTE Bands 7 And 30, TDD LTE Bands 38/41 And 40, And AXGP Band. This is the next generation in a line OnePlus has used before – you’ll find the Skyworks 77814-11 power amplifier module for LTE in the OnePlus 2

SkyWorks SKY77646 module here Multimode Multiband Power Amplifier Module For Quad-Band GSM/EDGE – Bands (1, 25, 3, 4, 26, 8, 13, 12, 20, 28, 34, And 39) WCDMA / HSDPA / HSUPA / HSPA+ / LTE

E56302 in gold here corresponds to the circuit board design

Bonus mi5

TearDown Hugo Barra, min 12:18 https://www.youtube.com/watch?v=Bf0G5R2eOCw
[Xiaomi Mi 5 Guides, News, & Discussion] RBSonic:
It can be VERY complicated!

Look, CPU/Modem has sotware instructon for each band.

For examle, Band 7

1. Antenna switcher: ant. port must be connected to port 7: 8x0000345 (not real, it's only example of sofware instruction!)

2. Power Amplefier: power on to amplifier number 7: 3x0034267

3. RF Transmitter: power on channel 7: 2x0120023

4. CPU/Modem: turn on band 7: 4x0000435

All this instructions must be wrote in flash rom or NV value or may be in CPU Rom, i don't know!

My question, where we can see this software for Bands, which are enabled?

Next problem.

You try to enable band 20, but i think there is no software for band 20 as such as for band 7 (from my example)!!!

It is not enough just to write: "RFNV_LTE_B20_TX_MULTI_LIN_V3_DATA_", because CPU don't know which device and how must be connected.

If you whrite RFNV_LTE_B7_TX_MULTI_LIN_V3_DATA_,, there is full sotware instruction (from my example) for Band 7, and all will work fine.

There is no software for Band 20 in Mi5. We must white it self. We need sotware instruction for each device and i/o ports of AS, AP, RF.

But, first we need original sotware and instruction for another bands, which work in Mi5. So we can see how CPU controlls AS, AP, RF if it works with band 1, 2, 7, .............
[Xiaomi Mi 5 Guides, News, & Discussion] pakidermo5000:
All your answers are in the QCN. Here you can see the extract of the QCN with the instructions that are currently in the mi5. We just have to write the instructions for the bands it does not have.

This is done by recovering a QCN with QPST because QPST will write whatever is in the file, but will not delete the info already present in the memory. It will only update it if already found in the memory.
[Xiaomi Mi 5 Guides, News, & Discussion] RBSonic:
G5 is not same mi5!

Mi5

http://www.ewisetech.com/Device/Mobile/Xiaomi-MI-5全网通标准版_id2277/BOM

G5

http://www.ewisetech.com/Device/Mobile/LG-G5(H686)_id2252/BOM

There are diffrent power amplifiers and antenna switchers. Only FR transmitter and CPU are same.

If you find software of RF Tramsmitter in your code, you can add this to mi5. But rest of software can not be used..
[Xiaomi Mi 5 Guides, News, & Discussion] pakidermo5000:
Yes, this is why some of the Items are not identical...

We have to work on this, we know. Little by little.
[Xiaomi Mi 5 Guides, News, & Discussion] RBSonic:
Antenna switcher has many output ports.

Power amplifier has many input port too.

It must be connected. For each connection you need sotware code. Some LTE Band can be connected together on one input port (see datasheet of power amplifier), but there must be diffent software code for this Bands.

May be this is not full sotware?
[Xiaomi Mi 5 Guides, News, & Discussion] greasymonkey1960:
Of course it is not the full software for an Android phone.

I suggest you have a look at non-HLOS.bin and the recently released Mi5 kernel source code to obtain a good understanding of the phone.
[Xiaomi Mi 5 Guides, News, & Discussion] RBSonic:
Can we change something in non-HLOS.bin?
[Xiaomi Mi 5 Guides, News, & Discussion] greasymonkey1960:
If you could have a look at that that aspect, it would be very helpful. I do not have time to spare at present.
[Xiaomi Mi 5 Guides, News, & Discussion] pakidermo5000:
This might help

http://xdaforums.com/oneplus-one/general/discussion-hlos-reverse-engineering-t3292829
[Xiaomi Mi 5 Guides, News, & Discussion] devilsden:
Hi all

I have a Mi5 64GB phone and I have a weird issue that I think has started after unlocking the bands. After unlocking the bands I noticed that mobile network is slow and most of the websites timeout (eg: google.com, yahoo.com) and some application time out too and/or extremely slow on mobile network (Have good reception). There is absolutely no issue when using WiFi

Network Speed test returns ~50MBps download speed.

Ping to google and yahoo work

I have done following stuff to try and fix the issue:

I have reinstalled the MIUI Global ROM 6.9.29

I also tried installing MIUI Global ROM 6.9.22

I did a clean install after wiping data/system/etc

Did a factory reset

Installed official MIUI 8.0.2.0 using fastboot (Full clean install)

Manually updated the modem

Updated firmware to MIUI 7.5.9.0 and MIUI 8.0.2.0

The issue does not exist when I install CM13 or Resurrection ROM or any CM based ROM. Everything seems to work just fine on these ROMS

Please advise what the issue is and if this can be fixed
[Xiaomi Mi 5 Guides, News, & Discussion] greasymonkey1960:
You do not provide any information about what LTE bands you have tried to unlock, how you attempted it, etc.

If you have started playing around without full backups of NVRAM and EFS partition, you are stuck.

There is never any guarantee that a method will work or not impact the performance of the device.

There no simple switch to enable new bands, and from current investigations, it appears that you need to derive characterisation curves based on the existing NVRAM data to develop the data-fill suited to your particular device - a lot of work and not for people without a high level of knowledge in mobile devices.
[Xiaomi Mi 5 Guides, News, & Discussion] Expliciate:
Great progress!

Just wondering, would it be of any help to analyzing and unlocking band 4 given a copy of a OnePlus 3 A3000 (NA) QCN?
[Xiaomi Mi 5 Guides, News, & Discussion] mightyvenom:
Thank you a million pakidermo! I have been stalling to buy this device and following this thread ever since. Lack of band 20 is a major letdown for me and I am waiting impaciently for you experimented users to finally solve it. It was clear from day 1 that Qualcomm and the antenna modules were able to support band 20, and you deserve full credit for not letting this in the dust.

Please make sure that you (and/or the other people responsible for this) will have an available paypal link for donation. I am sure that besides myself, there are others who are keen to reward this massive and important work!

Again, great job and good luck ahead!
[Xiaomi Mi 5 Guides, News, & Discussion] mtimmy:
Is it because mi5 have dual sim ?
[Xiaomi Mi 5 Guides, News, & Discussion] moti2408:
Hello everyone

first of all respect for the hard work really important progress

addition'd love to know if it can also be implemented on one plus 3 A3000 to open band 3

Thanks
[Xiaomi Mi 5 Guides, News, & Discussion] megthebest:
you can open a Thread on the device section.. here is Off Topics.

Thanks for understanding.

I want to thank you all for great effort in particular [MENTION=7046981]greasymonkey1960[/MENTION], [MENTION=2561364]smartpal[/MENTION] [MENTION=4381331]Sr_Vash[/MENTION] [MENTION=4339055]pakidermo5000[/MENTION]

really impressed on where you are now with hard work!
[Xiaomi Mi 5 Guides, News, & Discussion] pakidermo5000:
Well, this will definitely be of use to activate band 4. But let's start with B20 and B28. If they can be activated, then we can think of activating others. Step by step :)

Thank you very much. We have made a big progress but we are not there yet. Once we will have all the parameters, we will try if it works, which although looks like it should it is not 100% sure.

We are trying to do a very difficult thing here, which I think has never been done before. The inspiration came from Nexus5 and Nexus6 [MENTION=5256159]Azlun[/MENTION], who used the parameters of the american version of the phone to activate those bands to the european one. But, it is taking the parameters from the same phone, which kind of assures you it will work, and there is no need to extrapolate anything.

Here we are trying to use parameters from a different phone, it means we can not take them straight away but we have to figure them out analysing the patterns in the two phones and from other bands. The leap is significantly bigger and the challenge too.

We still have work to do, but I think we are on the right track.

Thanks.

Well, in principle it should but there is an extra step in the OP3 that needs to be sorted out before. Currently you can write on the NVRAM of OP3, but at reboot it goes back to the initial state.

We need a permanent patch for the nvram in order to be able to do a durable thing.

I repeat, we still don't know if it works. Let's check if it works with mi5, then we can think of other things.
[Xiaomi Mi 5 Guides, News, & Discussion] pakidermo5000:
Little advance. This bit strings are in little endian, no hex. Now, all makes more sense. One little step more.
[Xiaomi Mi 5 Guides, News, & Discussion] hornet17:
Hi,

I was googling around for some information and I found, there's another value in NV item list, which might be connected with supported lte bands:

65633 LTE Band preference

which has the same type as LTE BC config. It might be similar to wcdma band unlocking (there are band preference fields also). Maybe it is possible to try with this number? What is your value of this field?
[Xiaomi Mi 5 Guides, News, & Discussion] greasymonkey1960:
Hi, this field has the hex value of NV6828, for myself it is 0x80800D5, which equals the set value of 134742229.
[Xiaomi Mi 5 Guides, News, & Discussion] hornet17:
Are these your factory settings for Mi5? 134742229 looks like you already modified it. Does NV65633 change automatically with NV6828? Or you modified NV65633 manually with no result?
[Xiaomi Mi 5 Guides, News, & Discussion] greasymonkey1960:
Hi,

I have modified my settings for Bands 1, 3, 5, 7, 8, 20 and 28, as I am working on activating 20 and 28.

NV65633 changes automatically. When changing it manually it does not hold the value after reboot.
[Xiaomi Mi 5 Guides, News, & Discussion] pakidermo5000:
Pre-test phase...
[Xiaomi Mi 5 Guides, News, & Discussion] xdamami:
I hope you will found an solution. I have Op3 also want to unlock B20.

Maybe your methods will work on our devices.
[Xiaomi Mi 5 Guides, News, & Discussion] smartpal:
It is very strange that i could modify any nv value except 6828 and 6829. Even 65633 i could modify and the values stick after reboot on my M8. when ever i write the modified values QXDM tells that nv item written. but when i read it immediately the default value is shown.

I even tried to modify the qcn file with required bands and flash the modified qcn file using qpst. When i do so i lose my radio. But when i restart my phone i get the radio back and the default factory values are restored.

So it is obvious that either 6828 & 6829 are write protected or they pull the default factory value from somewhere else from the phone's embedded system i guess.

The reason i say this because when i flashed modified qcn i have lost the IMEI a couple of times. QPST and QXDM can detect the phone but cannot read or write the values. No communication from the phone The only solution was to flash the entire firmware and the IMEI was back.

So just as the IMEI is read from phone's embedded system(my guess) i think even the 6828 & 6829 default values are also read from there as well.

Appreciate if anyone has any idea where the nv values 6828 & 6829 are stored/read from( i.e which particular partition these values are stored/read from) so that we can find a way forward.

The reason i am writing this here even my phone is a different one because almost all other related threads are dead. This is one of the most active threads. Other reason is that the lte band unlocking procedure for qulacomm chipsets is almost the same.

If mods feel that it is off topic you may move it as necessary.
[Xiaomi Mi 5 Guides, News, & Discussion] fredda88:
Does this mean you made progress?
[Xiaomi Mi 5 Guides, News, & Discussion] pakidermo5000:
same situation in OP3. It looks like the phone checks the NVRam values at boot against something and overwrites them if they are not identical. Check the OP3 threadh. There was someone trying to find a patch.

---------- Post added at 05:58 PM ---------- Previous post was at 05:57 PM ----------

We are about to have a QCN...

I had one, but found out we forgot 3 Items more.

<NvItemData id="25539" name="RFNV_LTE_B8_TX_XPT_DELAY_I" compressed="false" variableSize="false" index="0" subscriptionid="0">

<NvItemData id="26625" name="RFNV_LTE_C0_B20_TX_ET_DELAY_OFFSETS_VS_FREQ_VS_TEMP_I" compressed="false" variableSize="false" index="0" subscriptionid="0">

<NvItemData id="28068" name="RFNV_LTE_C0_B20_PA_STATIC_Z_I" compressed="true" variableSize="false" index="0" subscriptionid="0">

When, done. we will have a QCN.
[Xiaomi Mi 5 Guides, News, & Discussion] greasymonkey1960:
I will look at these today, got a 24 hour wait in HK due to typhoon Haima...
[Xiaomi Mi 5 Guides, News, & Discussion] SgtIcetea:
I got a question. If you guys get this to work will it also work on the Mi5s? Or will it be a completely different story there? Thanks for your hard work!
[Xiaomi Mi 5 Guides, News, & Discussion] pakidermo5000:
probably similar story unless the mi5s comes with nvram write protected as the op3 or m8. In that case, nothing can be done unless a patch is found.
[Xiaomi Mi 5 Guides, News, & Discussion] kylemd:
You've probably looked at it already but wasn't there a NVRAM patch for the OP1 or OP2? Could use those as a starting point?
[Xiaomi Mi 5 Guides, News, & Discussion] mtimmy:
I dont think mi5 have the write protect implemented
[Xiaomi Mi 5 Guides, News, & Discussion] pakidermo5000:
Guys, this is offtopic. Let's stick to mi5, please.

To finish this:

Mi5 is ok, mi5s we don't know. Op3 and m8 are write protected and have no patch yet. The patch of op1 and op2 does not work on op3
[Xiaomi Mi 5 Guides, News, & Discussion] greasymonkey1960:
RFNV_LTE_B20_TX_XPT_DELAY_I

Completed, at 37,000 ft over Russia...... Kills the time on long-haul flights

Other outstanding items are in progress.

Cheers.
[Xiaomi Mi 5 Guides, News, & Discussion] mtimmy:
if you tell me more details about it i can work on the band 4 and 12
[Xiaomi Mi 5 Guides, News, & Discussion] greasymonkey1960:
There is no "how-to" on this, we are working through the different NVRAM items that are used for the LTE bands, combined with knowledge of software-defined radio, 3GPP requirements for LTE UE's, understanding of techniques for characterizing RF devices, and some guesses of how the resulting characterisation curves can be extrapolated/interpolated.

In general, an imprecise science with the hope of a useful result.
[Xiaomi Mi 5 Guides, News, & Discussion] kylemd:
Guess you could say you joined the mile-high developer club :cyclops:
[Xiaomi Mi 5 Guides, News, & Discussion] pakidermo5000:
Mi Note 2

has all bands...

http://en.miui.com/thread-386193-1-1.html

good news for mi5s, which can probably get all these bands activated by copying them from the Note 2.
[Xiaomi Mi 5 Guides, News, & Discussion] nikolaus2007:
But who wants to spend all that money to get 2 phones to only TRY if it works ... :D (but ok, this is off topic, my bad, sorry)
[Xiaomi Mi 5 Guides, News, & Discussion] tndb:
Any progress/news? :)
[Xiaomi Mi 5 Guides, News, & Discussion] greasymonkey1960:
Hi,

Progress is slow due to "real paid work" and family commitments - yes, I know, such a bore......

Currently working on the PA_STATIC file which is large, messy and not so easy to characterise and figure out a trend-line.

Also it is one of the critical files since it will impact power consumption/heating, so need to get it close as possible.

Cheers.
[Xiaomi Mi 5 Guides, News, & Discussion] tndb:
Thanks for the update

Real life commitments is such a pain :( (jokes aside)

If You manage to pull this of, then Im sure many people will donate to the cause (myself included ;) )
[Xiaomi Mi 5 Guides, News, & Discussion] xecuttor:
I'm ready to donate too. Watching this thread patiently.
[Xiaomi Mi 5 Guides, News, & Discussion] djmajino:
I am also willing to donate.. Is $20 enough? I am considering to sell Mi5 after 2 week of purchase only because of the lack of the band 20 support.. :( such a shame for this amazing device
[Xiaomi Mi 5 Guides, News, & Discussion] greasymonkey1960:
Let's not race ahead.... It is great to hear that people are willing to donate cash to the cause, it is most appreciated.

Once we have cracked this nut, then will be time enough for some payment.
[Xiaomi Mi 5 Guides, News, & Discussion] djmajino:
I didn't mean to race ahead.. sorry for that.. It's just that the Band 20 is majority for me because I live in vilage, and rural places has only Band 20 support in EU coutries. And about the $20. It is just an offer from me.. I think not everybody has that money to that, but hope this is good motivation for a start
[Xiaomi Mi 5 Guides, News, & Discussion] greasymonkey1960:
No problems - understand the pain living in a semi-rural area in EU too.

I have finished the characterisation of the PA_STATIC curves, and now do a cross-check on all the different parameters.

My plan is to do a test load into a Mi5 on Sunday and see if the device does a "Sammy Note 7"....... Hopefully all will proceed smoothly, so let's cross fingers, toes and eyes that it works.
[Xiaomi Mi 5 Guides, News, & Discussion] luxim:
Respect

[MENTION=7046981]greasymonkey1960[/MENTION] you've got my outmost respect, because you're trying to do something deemed almost impossible by a lot of people.

Good luck with your effort.
[Xiaomi Mi 5 Guides, News, & Discussion] efferre:
Wouldn't be easier to compare two phones from the same producer? For instance Zuk Z2 and Zuk Z2 Pro are very similar, the former doesn't have band 20 while for the latter it's enabled. How can I extract the QCN files for comparison?
[Xiaomi Mi 5 Guides, News, & Discussion] pakidermo5000:
Yes probably it would but we could not get hold of a zuk qcn.

To get it you need the Qualvomm drivers for Windows (i guess you have them already).

Then you can download QPST and extract the qcn, (export as. qcn)

Check this for how to, on a Lenovo Vibe

http://www.htcmania.com/showthread.php?t=1004269
[Xiaomi Mi 5 Guides, News, & Discussion] kevinzone:
so can someone kind of give me a guide for dummies on how to unlock the bands
[Xiaomi Mi 5 Guides, News, & Discussion] bobanbg:
There isn't a way to unlock the bands... At least for now.

It's a work in progress
[Xiaomi Mi 5 Guides, News, & Discussion] greasymonkey1960:
No party yet, I have modified or created a number of files for a new .qcn file, which has compiled and loaded OK to my Mi5, but no obvious sign of B20 jumping out of the woodwork.

I have a problem that there is a B3 eNodeB for Telefonica about 200 metres from my house, and even with Network Signal Guru having all but B20 LTE signals turned off, the phone will not "lose" the lock.
[Xiaomi Mi 5 Guides, News, & Discussion] tndb:
The only reception I have at home on LTE is B20 so I will know for sure if it will "bite" if you wanna share the qcn :)
[Xiaomi Mi 5 Guides, News, & Discussion] pakidermo5000:
I have analysed your file and there was a formatting error in one of the Items, maybe it was a problem...

You have a pm.
[Xiaomi Mi 5 Guides, News, & Discussion] djmajino:
I believe in you :)
[Xiaomi Mi 5 Guides, News, & Discussion] PetoNHL:
i live in a area where the band B20 is the only one for LTE... so i can test it. i'm using Xiaomi Redmi 3s now(opened bootloader, twrp, root... ), also i have an OnePlusOne device.
[Xiaomi Mi 5 Guides, News, & Discussion] pakidermo5000:
but do you have the mi5 ?? the QCN file generated here will only work with mi5 (if it works).
[Xiaomi Mi 5 Guides, News, & Discussion] greasymonkey1960:
Thanks for the offer, however the changes that we have done are for the Mi5, and as it uses different hardware, the calibration, delay and offset values have been tailored for this particular hardware set.
[Xiaomi Mi 5 Guides, News, & Discussion] pakidermo5000:
Guys, at the moment it does not seem work.

We have to figure out why.

Best case scenario: parameters need readjustment

Worst case scenario: there is no hardware to effectively handle band 800Mhz
[Xiaomi Mi 5 Guides, News, & Discussion] njeri123:
Now you can buy the 32GB variant with band 20.

m i. c o m / p l /

Gesendet von meinem E5823 mit Tapatalk
[Xiaomi Mi 5 Guides, News, & Discussion] Fortinho:
As far as I know even this one sold in some european market has no B20, as opposed to the two Redmis.

From http://www.abcdata.com.pl/xiaomi:
[Xiaomi Mi 5 Guides, News, & Discussion] pakidermo5000:
There is no mi5 with b20,so far.

Good news is that it seems is a matter of finding the right parameters. We will keep working on it!
[Xiaomi Mi 5 Guides, News, & Discussion] djmajino:
you are awesome guys 'bout how you are trying to accomplish it.. :)
[Xiaomi Mi 5 Guides, News, & Discussion] thedrickster:
I don't entirely understand the methodology being employed, so this might be a dumb question.........will it be possible to leverage your work on Band 20 in order to enable other bands presuming the hardware is in place? I'm thinking of US LTE bands, 4 (TMO & T), 12 (TMO), 17 (T), all of which appear on the SKY77646 specs.

4G FEATURES:

- Optimized for Envelope Tracking system

- LTE supports output power bandwidth bands 1, 25, 3, 4, 39,

26, 8, 20, 12, 17 (and sub-bands 9, 10, 18, 19)

- B4/12 and B3/8 carrier aggregation

- Flexible LB input configuration: any LB input for any band
[Xiaomi Mi 5 Guides, News, & Discussion] greasymonkey1960:
Assuming that we are successful with B20, as long as the hardware support is in the devices it should be possible.

The methodology used is only good for SDR (software defined radio) devices, as the filter characteristics, RF bands, frequencies, gains and offsets Vs temperature and other characteristics are all defined in the NVRAM items.

This work is painfully slow and involves a lot of educated guesswork, based on many years of RF R&D & testing experience.
[Xiaomi Mi 5 Guides, News, & Discussion] efferre:
Suggested software to decode qcn files? I have tried ocrt but it doesn't seem to fully support the XML schema.
[Xiaomi Mi 5 Guides, News, & Discussion] pakidermo5000:
The only one that works is qdart.
[Xiaomi Mi 5 Guides, News, & Discussion] QTeknology:
any news about this "FBRX_GAIN_FREQ_I"
[Xiaomi Mi 5 Guides, News, & Discussion] greasymonkey1960:
Initial version is done, along with all the others parameters, with some preliminary testing has been done with mixed results (B20 was reportedly seen on NSG tool, but no registration on network), awaiting more data/feedback to analyse the situation and decide next steps.
[Xiaomi Mi 5 Guides, News, & Discussion] a332682140:
I come from China, the forum can not be Chinese so there?