MDM9206 Data Features Overview: 80-P8101-7 Rev. C

MDM9206 Data Features Overview
80-P8101-7 Rev. C
Confidential and Proprietary – Qualcomm Technologies, Inc.
NO PUBLIC DISCLOSURE PERMITTED: Please report postings of this document on public servers or websites to: [email protected].
Restricted Distribution: Not to be distributed to anyone who is not an employee of either Qualcomm Technologies, Inc. or its affiliated companies without the express approval of
Qualcomm Configuration Management.

NO PUBLIC DISCLOSURE PERMITTED: Please report postings of this document on public servers or websites to: [email protected].
Restricted Distribution: Not to be distributed to anyone who is not an employee of either Qualcomm Technologies, Inc. or its affiliated companies without the express approval of Qualcomm Configuration Management.
Not to be used, copied, reproduced, or modified in whole or in part, nor its contents revealed in any manner to others without the express written permission of Qualcomm Technologies, Inc.
All Qualcomm products mentioned herein are products of Qualcomm Technologies, Inc. and/or its subsidiaries.
Qualcomm is a trademark of Qualcomm Incorporated, registered in the United States and other countries. Other product and brand names may be trademarks or registered trademarks of their respective owners.
This technical data may be subject to U.S. and international export, re-export, or transfer (“export”) laws. Diversion contrary to U.S. and international law is strictly prohibited.
Qualcomm Technologies, Inc.
5775 Morehouse Drive
San Diego, CA 92121
U.S.A.
© 2016-2018 Qualcomm Technologies, Inc. and/or its subsidiaries. All rights reserved.
PAGE 2 80-P8101-7 Rev. C June 2018 Confidential and Proprietary – Qualcomm Technologies, Inc. | MAY CONTAIN U.S. AND INTERNATIONAL EXPORT CONTROLLED INFORMATION
Revision History
Revision Date Description
A October 2016 Initial release
B July 2017 Added Slides 25-47
C June 2018 Updated Slide 32
Contents
 Data Features –Introduction

 NBIOT Features
 MTC/PSM Networking with NBIOT
 Release 11/12 Changes
 Release 13 Changes
 References
 Section Divider Slide
 Tables
 References
 Questions?
Data Features – Introduction
ThreadX Overview
 High-performance realtime kernel, designed specifically for embedded applications

 Threads are used as the executable modules in ThreadX, where "X" represents the context
switching
 Uses a nano-kernel or a pico-kernel architecture that has a small memory footprint
 Priority based pre-emptive scheduling
 Supports Preemption – Threshold technology
 32 default priority levels, extendable up to 1024 priority levels
 0 – Highest priority level
 Max priority number – Lowest priority level
 Low memory footprint
Note: ThreadX is a third-party real time operating system (RTOS).
APPS Software Stack
Applications
Client services/drivers
Core services/
driver
stdlib QuRT OSAL APIs and services
ThreadX
Hardware
MDM9206 Architecture Overview
MDM9206 ThreadX Comparison with MDM9x07 LE
Tech area/functionality MDM9x07 LE MDM9206 ThreadX

OS Related Features Linux OS ThreadX OS User Guide
SDK IoE-CM for Third-party Developers QuRT APIs (For Core OS services)
C-Type APIs for Data and GPS
WWAN Data Call Management C-Type APIs C-Type APIs
TCP/IP Sockets Programing Linux Sockets (BSD Library) QAPIs that are similar to BSD/Posix type socket interface
Data Networking Stack IPv4/IPv6, DNS client, DHCP client/server, DNS Proxy and NATing for tethering IPv4/IPv6, DNS Client, SSL/TLS
GPS C-Type APIs C-Type APIs
Additional QMI Services access (Voice, USIM, SMS, and so forth) IoE-CM, Uses QCCI Using QCCI
Peripheral Drivers USB, UART, SPI (No data tethering support over UART or SPI) USB, UART (Data tethering support is added over
UART)
Application and utilities Linux Utilities (Ping, Ifconfig/route, tcpdump, and so on) Apps/Utilities developed over internal networking stack
Embedded Data Architecture
Embedded Calls
DSI_NECTRL
 DSI_NETCTRL is now a shim layer that acts as an interface between the client and the NETMGR
 All architectural support (store and IFACE tables) for embedded calls in DSI_NETCTRL is moved to
NETMGR
 DSI_NETCTRL APIs are renamed as DSS APIs
Example:
 dsi_init  dss_init
 dsi_get_data_srvc_hndl  dss_get_data_srvc_hndl
 Up to four multi-PDN support
Tethering/DUN/Mux Architecture
MODEM A7 on ThreadX
QTI
DATA SERVICES
QTI_BRIDGE
COLOUR INDEX
3GPPMUX-DEMUX
GPS DATA40_ DATA40_ Legacy AT/DUN Path
CNTL CNTL
RmNet Control Path
DS_SMD DS_SMD
RmNet DATA Path
3GPP MUX FRAMES

SMD_DATA1 SMD_DATA1
LTE
DeMux Data
SMD_DATA2 SMD_DATA2
SMD_DATA3 SMD_DATA3
U
UART Driver A
R
T
TETHERED PC
BAM DMUX U
USB Driver S
B
A2
Tethering
 RmNet tethering
 Up to four PDNs with dual IP are supported
 Only on USB interconnect
 DUN tethering
 Single PDN IPv4 and IPv6
 DUN over USB and UART interconnects
 ECM tethering
 QMI Test Pro
 Support for single and multi RmNeT compositions
RmNet Tethering
MDM 9206
MODEM A7 on ThreadX
QTI (QMI Bridge, EP translator, Data Port Mapper)
QMI SERVICES
(WDS, DPM, NAS,…)
`QCSI QCCI
LTE
SMD IPC ROUTER

SMD
BAM DMUX USB Driver TETHERED PC

RmNet data driver
A2
DATA PATH
CONTROL PATH
PORT MAPPER
ECM Tethering
AT/DUN Over QTI Bridge
MDM 92 06
MODEM A7 on ThreadX
QTI_BRIDGE
3GPP/3GPP2
mode ATCoP
Handler
Packet WM
DS3GSIOLIB
LTE
DS SMD DS SMD SMD BRIDGE USB DUN Driver TETHERED PC / MCU
A2
DATA PATH
CONTROL PATH
Common Contol and Data

Path
AT FWD Service
QTI Responsibilities
 QTI is involved only in the control path for RmNet tethered path
 QTI acts as QMI bridge for most of the QMI messages between tethered PC and modem
 QTI does end point (EP) translation for QMI messages that have end point TLV in its message
structure
 Dynamic port mapper (DPM) functionality is used to open the modem port for the tethered call QMI
bridge
 QMI bridge exchanges the QMI control message between the tethered PC and the modem
 End point translation takes care of the end point translation for the QMI messages that have an end
point TLV in its message structure.
Muxing Protocol
 Muxing protocol Terminal Equipment to User Equipment (TE-UE) multiplexer protocol (3GPP TS 27.010) is supported to enable MUXing of
multiple logical channels over single physical channel
 Use case is concurrency of AT commands and DUN tethering over the serial interconnects like UART/SPI
 Logical channels are utilized for information exchange between MDM and external host to enable the OEM-specific use cases.
MDM 9206
MODEM A 7 on ThreadX
3 GPP MUX /DMUX MODULE
3GPP /3 GPP 2
mode ATCoP
Handler
Packet WM
DS 3 GSIOLIB
LTE
SMD _ DAT
A1
SMD _ DATA 1
DS SMD
SMD BRIDGE UART Driver TETHERED PC / MCU
DS SMD
A2
DUN DATA PATH
DUN CONTROL PATH
Common DUN Control and Data Path
AT Command Path
3 GPP MUX (AT / DUN data )
Security Stack (SSL/TLS/DTLS)
 ThreadX provides a secure communication between the transport and application layers.
 ThreadX uses the transport layer security services for applications by using TCP/UDP
 TCP uses transport layer security protocol (TLS)
 UDP uses datagram transport layer security protocol (DTLS)
 Security stack uses the following public and private key encryptions
 Asymmetric cryptography for key changes
 Symmetric cryptography for data channel encryption

 Security stack ensures the secure communications between application (client) and server (web server in cloud)
 Confidentiality
 Message integrity
 Authentication of keys
 Mutual authentication
 Digital signature
 Encryption Supported protocol version –
 Supported TLS/DTLS protocol versions TLS 1.0 –
TLS 1.1 –
TLS 1.2 –
DTLS 1.0 Based on TLS 1.1
DTLS 1.2 Based on TLS 1.2
SSL/TLS/DTLS Architecture
SSL enabled application protocols

SSL handshake protocol SSL change cipher spec protocol SSL alert protocol Application protocols
SSL record protocol
TCP
IP
Security Stack Supported Cipher Suites
TLS1.2/DTLS1.2 supported TLS1.1, TLS1.0 or DTLS 1.0

Ciphersuites Defined ciphersuites name ciphers supported ciphers only
TLS_NULL_WITH_NULL_NULL YES YES
PSK (preshared keys) TLS_PSK_WITH_RC4_128_SHA NO NO
TLS_PSK_WITH_3DES_EDE_CBC_SHA YES YES
TLS_PSK_WITH_AES_128_CBC_SHA YES YES
TLS_PSK_WITH_AES_256_CBC_SHA YES YES
TLS_PSK_WITH_AES_128_GCM_SHA256 YES NO
TLS_PSK_WITH_AES_256_GCM_SHA384 YES NO
TLS_PSK_WITH_AES_128_CBC_SHA256 YES No
TLS_PSK_WITH_AES_256_CBC_SHA384 YES NO
ECDHE_ECDSA (Ephemeral Elliptic curve TLS_ECDHE_ECDSA_WITH_NULL_SHA YES YES
Diffie–Hellman with Elliptic Curve Digital
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA NO NO
Signature Algorithm key)
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA YES YES
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA YES YES
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA YES YES
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 YES NO
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 YES NO
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 YES NO
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 YES NO
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 YES NO
Security Stack Supported Cipher Suites (cont.)
TLS1.2/DTLS1.2 supported TLS1.1, TLS1.0 or DTLS 1.0

Ciphersuites Defined ciphersuites name ciphers supported ciphers only
ECDH_ECDSA (Elliptic curve Diffie–Hellman with TLS_ECDH_ECDSA_WITH_NULL_SHA YES YES
Elliptic Curve Digital Signature Algorithm key)
TLS_ECDH_ECDSA_WITH_RC4_128_SHA NO NO
TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA YES YES
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA YES YES
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA YES YES
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 YES NO
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 YES NO
TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 YES NO
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 YES NO
ECDHE_RSA TLS_ECDHE_RSA_WITH_NULL_SHA YES YES
TLS_ECDHE_RSA_WITH_RC4_128_SHA NO NO
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA YES YES
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA YES YES
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA YES YES
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 YES NO
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 YES NO
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 YES NO
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 YES NO
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 YES NO
TLS1.2/DTLS1.2 TLS1.1, TLS1.0 or DTLS 1.0

Ciphersuites Defined ciphersuites name supported ciphers supported ciphers only
ECDH_RSA TLS_ECDH_RSA_WITH_NULL_SHA YES YES
TLS_ECDH_RSA_WITH_RC4_128_SHA NO NO
TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA YES YES
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA YES YES
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA YES YES
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 YES NO
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 YES NO
TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 YES NO
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 YES NO
DHE_RSA (Diffie Hellman signed using RSA keys) TLS_DHE_RSA_WITH_DES_CBC_SHA YES YES
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA YES YES
TLS_DHE_RSA_WITH_AES_128_CBC_SHA YES YES
TLS_DHE_RSA_WITH_AES_256_CBC_SHA YES YES
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 YES NO
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 YES NO
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 YES NO
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 YES NO
TLS_DHE_RSA_WITH_AES_128_CCM YES NO
TLS_DHE_RSA_WITH_AES_256_CCM YES NO
TLS_DHE_RSA_WITH_AES_128_CCM_8 YES NO
TLS_DHE_RSA_WITH_AES_256_CCM_8 YES NO
TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 YES NO
Ciphersuites Defined ciphersuites name TLS1.2/DTLS1.2 supported ciphers TLS1.1, TLS1.0 or DTLS 1.0 supported ciphers only
RSA TLS_RSA_WITH_NULL_MD5 YES YES
TLS_RSA_WITH_NULL_SHA YES YES
TLS_RSA_WITH_RC4_128_MD5 NO NO
TLS_RSA_WITH_RC4_128_SHA NO NO
TLS_RSA_WITH_DES_CBC_SHA YES YES
TLS_RSA_WITH_3DES_EDE_CBC_SHA YES YES
TLS_RSA_WITH_AES_128_CBC_SHA YES YES
TLS_RSA_WITH_AES_256_CBC_SHA YES YES
TLS_RSA_WITH_NULL_SHA256 YES NO
TLS_RSA_WITH_AES_128_CBC_SHA256 YES NO
TLS_RSA_WITH_AES_256_CBC_SHA256 YES NO
TLS_RSA_WITH_AES_128_GCM_SHA256 YES NO
TLS_RSA_WITH_AES_256_GCM_SHA384 YES NO
TLS_RSA_WITH_AES_128_CCM YES NO
TLS_RSA_WITH_AES_256_CCM YES NO
TLS_RSA_WITH_AES_128_CCM_8 YES NO
TLS_RSA_WITH_AES_256_CCM_8 YES NO
NBIOT Features
NBIOT Specific Features
 Control plane CIoT EPS optimizations

 The UE support request of PDN connectivity with CP CIoT optimization (during the attach procedure or
standalone UE requested PDN connectivity procedure). In this case RS/RA, if applicable, is transported over
control plane.
 After the PDN has been established with CP CIoT optimization, the UE supports the use of ESM data
transport message for data transfer over the control plane. If a UE is in the RRC idle, the ESM data transport
message is contained in the control plane service request message.
 Switching between control and data plane to send data based on predefined threshold of the accumulated
data
 Header compression for CP CIoT optimization
 Negotiation of ROHC configuration during PDN connectivity/attach request and EPS bearer modification
procedure
 Supports serving PLMN rate control IE
 Control rate per PDN per 6 mins interval with rate control value. 0xFFFF value means no restriction
NBIOT Specific Features (cont.)
 Non-IP data support

 Support for Non-IP data over control plane.
 The UE specifies “non IP” in the PDN type IE in the PDN connectivity request message.
 Header compression configuration IE not included while requesting “non IP” PDN type in PDN connectivity
request.
 Supports two new PCO parameters particularly, requesting “Non-IP Link MTU Request” in the PDN
connectivity request message and receipt of “Non-IP Link MTU” in the default EPS bearer context activation
message.
 Upon receipt of the Non-IP Link MTU size, the UE provides the MTU size to the applications that are connected to this
non-IP type PDN Non-IP Link MTU Request.
 Support for release assistance indication IE contained in the ESM data transport message for both
IP and non-IP type data connection.
 00: No information available
 01(1): No further uplink or downlink data transmission subsequent to the uplink data transmission is expected
 10(2): Only a single downlink data transmission and no further uplink data transmission subsequent to the
uplink data transmission is expected.
NBIOT Specific Features (cont.)
 Support for ePCO/eDRX

 MO exceptional data handling:
 MO exception data is specific to NBIOT and refers to data that the client sends with higher priority.
 The UE provides QMI interface for application to trigger the attach procedure during access barred.
 While T3396 is running for a PDN, the UE allows the client to send data packet tagged with MO exception.
 MO exceptional data sends to both non-IP data type and IP data type PDN connection.
MTC/PSM Networking with NBIOT
MTC/PSM Networking with NBIOT
 MTC
 Support for low priority signaling indication in NAS messages for data centric M2M and IoT devices. UIM
stores the information related to low priority signaling.
 PSM
 Provides an interface to the Application layer such that applications request:
 Use of PSM and/or request to stop using PSM
 Set or change the requested active time value and periodic TAU timer value
 Query the active time value and periodic TAU timer value requested by device, and provided by network and in use by
device for PSM activation/deactivation.
 While entering the PSM mode for a NBIOT device, all information related to PDN context is stored
including “CP only”, PCO, APN, IP address, IPV6 IID, EPS ID, header compression, serving PLMN,
and non-IP data type, network override IP in EFS.
 While exiting the PSM mode, for a NBIOT device, all information related to PDN context is restored
including “CP only”, PCO, APN, IP address, IPV6 IID, EPS ID, header compression, serving PLMN,
and non-IP data type, network override IPonto UE.
Release 11/12 Changes
Release 11/12 Changes
 Provides support for QCI values 65, 66, 69, and 70. If the UE receives a QCI value in spare range
(10-64, 67, 68, 71-127), then the UE maps these to QCI 1-9 GBR or NGBR based on the
guaranteed bit rate IE. QCI 128-254 are operator reserved.
 The UE (LTE Rel.>=10 or UMTS Rel.>=1) is configured to use AC11-15. The UE initiates the attach
procedure (LTE/UMTS) even if the t3396 timer is running.
 PDP address comparison handling is done in DS. As part of this feature, the UE tears down the
PDP connection if the network gives different PDP address in modify PDP request, compared to
activate PDP message.
Release 11/12 Changes (cont.)
 Network overridden IP type is cleared or reset when the PDP context associated with the APN is
de-activated with any of the following reasons:
 PDP context synchronization during routing area update or service request procedure
 Network cause type: SM_NETWORK_CAUSE
 Network cause code: PDP_UNKNOWN_REASON (14)
 PDP context deactivation initiated by the network
 Network cause type: SM_NETWORK_CAUSE
 Network cause code: (Any network cause codes)
 Detach from GPRS services; or
 Network cause type: SM_INTERNAL_CAUSE
 Network cause code: NO_GPRS_CONTEXT (6)
 A service request procedure is rejected with cause #40 "No PDP context activated"
 Network cause type: SM_INTERNAL_CAUSE
 Network cause code: SM_NO_PDP_CONTEXT_ACTIVATED (29)
Back-off Timer Behavior Release 12
Bearer Bearer
PDN Resource Resource PDN
Connectivity Allocation Modification Disconnect
Event Request Request Request Request
PDN Connectivity Reject (ESM=26,T3396= non-zero non-deactivate) N N N Y
PDN Connectivity Reject (ESM≠26,Back-off= non-zero non-deactivate) N Y Y Y
Bearer Resource Allocation Reject (ESM=26,T3396= non-zero non-deactivate) N N N Y
Bearer Resource Allocation Reject (ESM≠26,back-off= non-zero non-deactivate) Y N Y Y
Bearer Resource Modification Reject (ESM=26,T3396= non-zero non-deactivate) N N N Y
Bearer Resource Modification Reject (ESM≠26,back-off= non-zero non-deactivate) Y Y N Y
Deactivate Context Bearer Request (ESM=26,T3396= non-zero non-deactivate) N Y Y Y
Release 13 Changes
ePLMN List – Release 13
 The UE stores a list of ePLMNs

 Equivalent to each other for PLMN selection and cell selection/re-selection
 USIM stores information about HPLMN and eHPLMN (EFeHPLMN) with priority.
 The UE updates or deletes list of ePLMNs at the end of attach or TAU
 List of ePLMNs is the sum downloaded in attach/TAU and PLMN code of the registered PLMN that
downloaded the list.
 The maximum number of possible entries of ePLMN list = 16
 For ESM cause#26 network may additionally indicate in the re-attempt indicator that a command to
back-off is applicable not only for the PLMN in which the UE received the EPS session management
reject message, but also for each PLMN included in the equivalent PLMN list at the time when the
EPS session management reject message was received.
PDN Reject with ESM#50 and ESM#5 – Release 13
 The UE ignores the value of the RATC bit in the re-attempt

indicator IE provided by the network.
 It is always allowed to re-attempt in other RAT UE eNB/MME
 The UE sends another PDN connectivity request message for the
PLMN1
same APN using the same PDN type, if
PDN Connectivity Request (IPv4v6,APNi)
 The UE is registered to a new PLMN and either
PDN Connectivity Reject
 Network did not include a re-attempt indicator IE in the connectivity reject (ESM#50)
message or Or PDN Connectivity Reject

(ESM#50, RATC=any, EPLMNC=0)
 Re-attempt indicator IE included in the message indicates that re-attempt in an
equivalent PLMN is allowed
PLMN2
PDN Reject with ESM#66 – Release 13
Back-off timer EPLMNC Behavior

Not included Not included or The UE does not send another PDN CONNECTIVITY REQUEST message for the same APN in the current PLMN in S1 mode until the UE is
EPLMN=0 switched off or the USIM is removed.
Not included 1 The UE does not send a PDN CONNECTIVITY REQUEST message for the same APN in any PLMN in the list of equivalent PLMNs in S1 mode until
the UE is switched off or the USIM is removed.
Neither zero nor de- 0 The UE sends PDN CONNECTIVITY REQUEST message for the same APN in other PLMN in the list of equivalent PLMNs.
activated
Neither zero nor de- 1 The UE additionally starts a back-off timer with the value provided in the Back-off timer value IE for the PDN connectivity procedure for each
activated combination of a PLMN from the equivalent PLMN list and the APN.
De-activated 0 The UE sends PDN CONNECTIVITY REQUEST message for the same APN in other PLMN in the list of equivalent PLMNs.
De-activated 1 The UE deactivates the respective back-off timers for the PDN connectivity procedure for each combination of a PLMN from the equivalent PLMN list
and the APN.
 Cause 66 = requested APN not supported in current RAT and PLMN combination
 The UE ignores the value of the RATC bit in the re-attempt indicator
PDN Reject with ESM#8, #27, #32, #33 – Release 13
Back-off SM_RetryWait SM_RetryAtRAT

timer EPLMNC RATC time change Behavior
Included 0 0 Any Any The UE starts or deactivates back-off timer for S1 mode in current PLMN.
Included 0 1 Any Any The UE starts or deactivates back-off timer for A/Gb, Iu, and S1 mode in current PLMN.
Included 1 0 Any Any The UE starts or deactivates back-off timer for S1 mode in all ePLMNs .
Included 1 1 Any Any The UE starts or deactivates back-off timer for A/Gb, Iu, and S1 mode in all ePLMNs.
Included Not included Not included Any Allow The UE starts or deactivates back-off timer for S1 mode in current PLMN.
Included Not included Not included Any Not allowed The UE starts or deactivates back-off timer for A/Gb, Iu, and S1 mode in current PLMN.
Included Not included Not included Any Not included The UE starts or deactivates back-off timer for S1 mode in current PLMN (applied to A/Gb, Iu mode
unspecified).
PDN Reject with ESM#8, #27, #32, #33 – Release 13 (cont.)
Back-off SM_RetryWait
timer EPLMNC RATC Time SM_RetryAtRATChange Behavior
Not included Ignore Ignore Config Allow The UE starts or deactivates the back-off timer (=SM_RetryWaitTime) for S1 mode in current PLMN.
Not included Ignore Ignore Config Not allowed The UE starts or deactivates back-off timer (=SM_RetryWaitTime) for A/Gb, Iu, and S1 mode in current
PLMN.
Not included Ignore Ignore Config Not included The UE starts or deactivates back-off timer (=SM_RetryWaitTime) for S1 mode in current PLMN.
Not included Ignore Ignore Not config Allow The UE starts back-off timer (= 12 min) for S1 mode in current PLMN.
Not included Ignore Ignore Not config Not allowed The UE starts back-off timer (= 12 min) for A/Gb, Iu, and S1 mode in current PLMN.
Not included Ignore Ignore Not config Not included The UE starts back-off timer (= 12 min) for S1 mode in current PLMN.
PDN Reject with other ESM – Release 13
Back-off timer EPLMNC RATC Behavior

Included 0 0 The UE starts or deactivates back-off timer for S1 mode in current PLMN.
Included 0 1 The UE starts or deactivates back-off timer for A/Gb, Iu, and S1 mode in current PLMN.
Included 1 0 The UE starts or deactivates back-off timer for S1 mode in all ePLMNs .
Included 1 1 The UE starts or deactivates back-off timer for A/Gb, Iu, and S1 mode in all ePLMNs.
Included Not included Not included The UE starts or deactivates back-off timer for S1 mode in current PLMN.
Not included Ignore Ignore The UE is allowed to retry same APN in any PLMN and any RAT.
New ESM Added to PDN Reject – Release 13
 ESM #113 = Multiple accesses to a PDN connection not allowed.

 This ESM cause is used by the network to indicate that multiple accesses to a PDN connection for NBIFOM
is not allowed.
 It is also used with EPS bearer context deactivation initiated by the network.
 ESM #57 = PDN type IPv4v6 only allowed
 ESM #58 = PDN type non IP only allowed
 Retry behavior for ESM #50, #51, #57, and #58 are the same.
PDN Deactivation – Release 13
 New reset condition for T3396 = deactivate with ESM#26 (received).

 DEACTIVATE EPS BEARER CONTEXT REQUEST message including ESM cause #39 "reactivation
requested" for a default EPS bearer context for the same APN from the network.
 EPS bearer context deactivation
 When the network provides a back-off timer in the network initiated EPS bearer deactivation to the UE, the
UE does not re-attempt the PDN connectivity request, bearer resource modification request, or bearer
resource allocation request message for the same APN as well while T3396 is running.
 The UE requested PDN disconnection procedure not accepted by the network
 If the UE receives ESM cause #49 "last PDN disconnection not allowed" and the UE has any other PDN
connections established; the UE locally deactivates, without peer-to-peer signalling between the UE and the
MME. All EPS bearer contexts associated with those are other PDN connections.
IP Address Allocation – Release 13
 With ESM#50 & ESM#51

 Following rest condition in Release 12 is removed UE eNB/MME
 The UE is switched off
 USIM is removed ESM #50, ESM#51
 Reason for removing
Activate Default EPS Bearer Context Request (APNi)
 After adding the new condition iii) detach, the two existing (ESM#50)
conditions, switching off the UE and removing the USIM
become redundant. The redundancy occurs because the
Detach
detach procedure is triggered when the UE is switched off or USIM removed or
SIM/USIM is removed. OFF/ON PDN Connectivity Request (IPv4v6,APNi)
 If the UE wants to get the PDN connectivity without IP,

the UE sets PDN type IE in the PDN CONNECTIVITY Non IP
REQUEST message to "non IP“. PDN Connectivity Request (non IP,APNi)
 Network does not initiate a dedicated bearer context Activate Default EPS Bearer Context Request (APNi)
activation procedure for established PDN connections of Bearer Resource Allocation Request (APNi)
Dedicated bearer
"non IP" PDN type. Bearer Resource Allocation Reject
not allowed
 Therefore, the UE is not required to check IP status

before sending the dedicated bearer procedure.
NULL APN for Additional PDN – Release 13
 For any 3GPP release, “Access Point Name IE” does not need to be included for additional
emergency PDN connectivity request
 For 3GPP release ≤ 12, for other cases, additional PDN connectivity request includes “Access Point
Name IE”
 For 3GPP release ≥ 13, NULL APN is allowed based on
 Request connectivity to an additional PDN using a specific APN, the UE includes the requested APN in the
PDN CONNECTIVITY REQUEST message
 Use case: The UE requests for an additional PDN (= same APN used for attach) to use NULL APN; not all
UEs know the attach APN
 T3396 is associated to specific APN or NULL APN as used in PDN connectivity request
NB IOT NV Items
 Control plan configuration with NV73916

 1 – CPU only mode (default)
 7 – CP+S1-U
 85 – CP+S1-U+HC
 257 – ePCO
 AUTH related configuration with NV73602 value
 0x00 – PDN AUTH PAP
 0x01 – PDN AUTH CHAP
 MO exception data handling
 To configure the device MO exception support, MO exception data allowed on the USIM's EFNASCONFIG
has to be enabled. Using a card reader USIM is provisioned Characteristics of the Universal Subscriber
Identity Module (USIM) application (Release 14 3GPP specification TS.31.102). Look for EFID 6FE8 and
provision the parameter for an exception data reporting allowed value. It auto generates the efnas_config file.
 NV73910 to be set to 7 for additional DS messages
 NV 73769 to enable the PSM feature. Set psm_enabled to 1 and a threshold value is not required.
MDM9206.TX.2.0 Features Summary
 Following are the key features introduced in ThreadX 2.0

 More details on these features are obtained in documents mentioned in the reference section
Feature Reference
Support for ThreadX downloadable application modules (DAM) [R1]
Support HTTP and HTTPS. QAPI document is updated with relevant API [R2]
FOTA support using LWM2M and HTTPS [R3]
New VZW Requirements [R7]
References
References
Documents
Title Number
Qualcomm Technologies, Inc.
MDM9206 ThreadX downloadable application module user guide 80-P8101-12
QUALCOMM application programming interface for MDM9206 ThreadX OS 80-P8101-14
MDM9206 ThreadX LWM2M FOTA user guide 80-P8101-13
MDM9206 lightweight M2M user guide 80-P8101-15
ThingSpace SDK Rel 2.0 interface specification 80-PC345-1
Release Note: ThingSpace SDK version 2.0.0 80-PB403-4
MDM9206 lightweight M2M management object compliance matrix for Verizon wireless 80-P8101-18
MDM9206 lightweight M2M management object compliance matrix 80-P8101-17
Standards
Title Standard Number
(June 2002)
Resources
References (cont.)
Acronyms
Acronym or term Definition

DPM Data port mapper
DTLS Datagram transport layer security
DTLS Datagram transport layer security
QMI Qualcomm modem Interface
SPI Serial peripheral interface
SPI Serial peripheral interface
SSL Secured socket layer
SSL Secured socket layer
TCP Transmission control protocol
TCP Transmission control protocol
TLS Transparent layer security
TLS Transparent layer security
UART Universal asynchronous receiver/transmitter
UART Universal asynchronous receiver/transmitter
UDP User datagram protocol
Questions?
https://createpoint.qti.qualcomm.com

MDM9206 Data Features Overview: 80-P8101-7 Rev. C

Uploaded by

Copyright:

Available Formats

MDM9206 Data Features Overview: 80-P8101-7 Rev. C

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

MDM9206 Data Features Overview: 80-P8101-7 Rev. C

Uploaded by

Copyright:

Available Formats

MDM9206 Data Features Overview

Confidential and Proprietary – Qualcomm Technologies, Inc.

Confidential and Proprietary – Qualcomm Technologies, Inc.

Revision Date Description

A October 2016 Initial release

B July 2017 Added Slides 25-47

C June 2018 Updated Slide 32

 Data Features –Introduction

 High-performance realtime kernel, designed specifically for embedded applications

Note: ThreadX is a third-party real time operating system (RTOS).

stdlib QuRT OSAL APIs and services

Tech area/functionality MDM9x07 LE MDM9206 ThreadX

RmNet Control Path

3GPP MUX FRAMES

QTI (QMI Bridge, EP translator, Data Port Mapper)

SMD IPC ROUTER

BAM DMUX USB Driver TETHERED PC

DS SMD DS SMD SMD BRIDGE USB DUN Driver TETHERED PC / MCU

Common Contol and Data

3 GPP MUX /DMUX MODULE

DUN DATA PATH

DUN CONTROL PATH

Common DUN Control and Data Path

3 GPP MUX (AT / DUN data )

 Symmetric cryptography for data channel encryption

SSL enabled application protocols

TLS1.2/DTLS1.2 supported TLS1.1, TLS1.0 or DTLS 1.0

TLS1.2/DTLS1.2 supported TLS1.1, TLS1.0 or DTLS 1.0

TLS1.2/DTLS1.2 TLS1.1, TLS1.0 or DTLS 1.0

 Control plane CIoT EPS optimizations

 Non-IP data support

 Support for ePCO/eDRX

PDN Connectivity Reject (ESM≠26,Back-off= non-zero non-deactivate) N Y Y Y

Bearer Resource Allocation Reject (ESM=26,T3396= non-zero non-deactivate) N N N Y

Bearer Resource Allocation Reject (ESM≠26,back-off= non-zero non-deactivate) Y N Y Y

Bearer Resource Modification Reject (ESM=26,T3396= non-zero non-deactivate) N N N Y

Bearer Resource Modification Reject (ESM≠26,back-off= non-zero non-deactivate) Y Y N Y

Deactivate Context Bearer Request (ESM=26,T3396= non-zero non-deactivate) N Y Y Y

 The UE stores a list of ePLMNs

 The UE ignores the value of the RATC bit in the re-attempt

message or Or PDN Connectivity Reject

Back-off timer EPLMNC Behavior

Back-off SM_RetryWait SM_RetryAtRAT

Back-off timer EPLMNC RATC Behavior

 ESM #113 = Multiple accesses to a PDN connection not allowed.

 New reset condition for T3396 = deactivate with ESM#26 (received).

 With ESM#50 & ESM#51

 If the UE wants to get the PDN connectivity without IP,

 Therefore, the UE is not required to check IP status

 Control plan configuration with NV73916

 Following are the key features introduced in ThreadX 2.0

Qualcomm Technologies, Inc.

MDM9206 ThreadX downloadable application module user guide 80-P8101-12

QUALCOMM application programming interface for MDM9206 ThreadX OS 80-P8101-14

MDM9206 ThreadX LWM2M FOTA user guide 80-P8101-13

MDM9206 lightweight M2M user guide 80-P8101-15

ThingSpace SDK Rel 2.0 interface specification 80-PC345-1

Release Note: ThingSpace SDK version 2.0.0 80-PB403-4

MDM9206 lightweight M2M management object compliance matrix 80-P8101-17