FCC ID: B94T77H468 3GPP Long Term Evolution Cat3 PCI Express M.2 Module

COMPANY CONFIDENTIAL 3GPP Long Term Evolution Cat3 PCI Express M.2 Module User Manual Project code: T77H468 Solution: MDM9615+WTR1605L SKU: NA-1-S3 Copyright 2013. Foxconn Communications Inc. All rights reserved.

- 1 -

COMPANY CONFIDENTIAL Reviewers Department Name Signature Review Dates

* Plan

** Results Project Manager Choro.Chung Project Leader Ai-ning Song Hardware Engineer Yannie.Zhang Modification History Rev Date Originator Comment D0.1 2013/01/04 Ai-ning Initial release D1.1 2013/03/06 Ai-ning Update to MDM9615 version (S2 version) D2.0 2013/04/13 Ai-ning Update to MDM9615 NA SKU D3.0 2013/06/26 Ai-ning Update system connection

- 2 -

COMPANY CONFIDENTIAL CONTENTS 1. GENERAL DESCRIPTION......................................................................4 1.1 SYSTEM MAIN FEATURE ......................................................................5 1.2 SYSTEM BLOCK DIAGRAM ..................................................................8 1.3 PIN DEFINITION .......................................................................................9 1.4 PLATFORM CONNECTION DESIGN .................................................14 2. HARDWARE FEATURES .....................................................................22 2.1 MOBILE DATA MODEM...............................................................................22 2.2 RF TRANSCEIVER........................................................................................23 2.3 POWER MANAGEMENT IC ........................................................................23 2.4 ANTENNA DESIGN .......................................................................................24 3. MECHANICAL SPECIFICATIONS ......................................................27 3.1 OVERVIEW .....................................................................................................27 3.2 MECHANICAL CONSTRAINTS ..................................................................27 3.3 M.2 CARD ASSEMBLY ................................................................................28 4. ELECTRICAL SPECIFICATIONS........................................................29 4.1 RECOMMENDED OPERATING CONDITIONS .......................................29 4.2 POWER CONSUMPTION.............................................................................29 5. RF PERFORMANCE SPECIFICATIONS ...........................................30 5.1 RF MAXIMUM TX POWER SPECIFICATIONS........................................30 5.2 RF MIN. RX SENSITIVITY SPECIFICATIONS .........................................31 6. SOFTWARE REQUIREMENTS ...........................................................32

- 3 -

1. General Description COMPANY CONFIDENTIAL T77H468 is designed to enable wireless data connectivity for notebook computer or any other device compatible with the PCI Express M.2 Specification 3042 type slot. T77H468 is the data card solution that delivers wireless wide-area network (WWAN) connectivity for the LTE, UMTS (HSDPA/HSUPA/HSPA+/DC-HSPA+), CDMA 1X/CDMA EV-DOrA/ CDMA EVDO-rB, GSM/GPRS/EDGE and GPS/Glonass protocols in one hardware configuration. WTR1605L G C W L QUAD BAND BC 0,1 Band 1,2,4, 5,8 Band 2,4,5,13,17,25 SKU NA-1-S3 TX_LB1 TX_LB2 TX_LB3 TX_LB4 TX_MB1 TX_MB2 TX_MB3 TX_MB4 TX_HB PRX_LB1 PRX_LB2 PRX_LB3 PRX_MB1 PRX_MB2 PRX_MB3 PRX_HB DRX_LB1 DRX_LB2 DRX_LB3 DRX_MB DRX_HB 850/900 1800/1900 850/900 1800/1900 0 1 0 1 0 1 5,8 4 1,2 8 5 2 1 4 5,8 2 1,4 17 13 5, 8r 4 1r, 2,25 13,17 5 2 4 5 17 13 2,25 4 4 1.1 System Main Feature Feature Physical Electrical Dimension Shielding design Weight USIM Operating Bands Diversity/2nd Rx COMPANY CONFIDENTIAL Description PCI express M.2 module, size 3042, 75Pin golden finger Single VCC supply (3.3V+/-5% follow M.2 standard) Dimensions (L W H): 42 mm 30 mm 2.3 mm, maximum height=2.38mm (add PCB tolerance=0.08mm) Shield case on board design, no additional shielding requirement Approximately 6.2g Off-board USIM connector supported WCDMA/HSDPA/HSUPA/HSPA+ operating bands:

Band 1: 1920 to 1980 MHz (UL), 2110 to 2170 MHz (DL) Band 2: 1850 to 1910 MHz (UL), 1930 to 1990 MHz (DL) Band 4: 1710 to 1755 MHz (UL), 2110 to 2155 MHz (DL) Band 5: 824 to 849 MHz (UL), 869 to 894 MHz (DL) Band 8: 880 to 915 MHz (UL), 925 to 960 MHz (DL) GSM operating bands:

GSM850: 824 to 849 MHz (UL), 869 to 894 MHz (DL) E-GSM900: 880 to 915 MHz (UL), 925 to 960 MHz (DL) DCS1800: 1710 to 1785 MHz (UL), 1805 to 1880 MHz (DL) PCS1900: 1850 to 1910 MHz (UL), 1930 to 1990 MHz (DL) LTE FDD operating bands:

Band 2: 1850 to 1910 MHz (UL), 1930 to 1990 MHz (DL) Band 4: 1710 to 1755 MHz (UL), 2110 to 2155 MHz (DL) Band 5: 824 to 849 MHz (UL), 869 to 894 MHz (DL) Band 13: 777 to 787 MHz (UL), 746 to 756 MHz (DL) Band 17: 704 to 716 MHz (UL), 734 to 746 MHz (DL) Band 25: 1850 to 1915 MHz (UL), 1930 to 1995 MHz (DL) CDMA 1X/CDMA EV-DOrB operating bands:

BC0: 824 to 849 MHz (UL), 869 to 894 MHz (DL) BC1: 1850 to 1910 MHz (UL), 1930 to 1990 MHz (DL) All WCDMA/HSDPA/HSUPA/HSPA+ operating bands All CDMA 1X/CDMA EVDO operating bands All LTE operating bands GNSS GPS: L1 (1575.42MHz) GLONASS: L1 (1602MHz) USIM Voltage Support 1.8V and 2.85V, and auto detects follow SIM card type Antenna connectors MAIN and AUX(supports Diversity and GPS simultaneously) 5 Throughput COMPANY CONFIDENTIAL GPRS: DL 85.6 kbps /UL 85.6 kbps EDGE: DL 236.8 kbps/UL 236.8 kbps WCDMA CS: DL 64 kbps /UL 64 kbps WCDMA PS: DL 384 kbps /UL 384 kbps HSPA+: DL 21.6 Mbps /UL 5.76 Mbps DC-HSPA+ :DL 42 Mbps/UL 5.76 Mbps CDMA 1x: DL 153.6 kbps/UL 153.6 kbps EVDO Rev.A: DL 3.1 Mbps /UL 1.8 Mbps EVDO Rev.B: DL 14.7 Mbps/UL 5.4 Mbps LTE FDDDL:100 Mbps/UL 50 Mbps @20M BW cat3 LTE air interface LTE R9, Cat3, 20MHz BW (FDD: up to 100 Mbps downlink, 50 Mbps uplink)

 FDD: up to 100 Mbps downlink, 50 Mbps uplink

 1.4 to 20 MHz RF bandwidth

 1X2 MISO (1Tx and 2Rx for two downlinks simultaneously)

IPv6, QoS WCDMA/HSPA air interface

 R99:

All modes and data rates for WCDMA FDD

 R5 HSDPA PS data speeds up to 7.2 Mbps on the downlink

 R6 HSUPA E-DCH data rates of up to 5.76 Mbps for 2 ms TTI (UE category 6) uplink

 R7 HSPA+

Downlink 64 QAM; up to 21 Mbps 1X2 MISO (1Tx and 2Rx for two downlinks simultaneously) 2Rx with 16 QAM; up to 28 Mbps Uplink 16 QAM; up to 5.76 Mbps

 R8 DC-HSPA+

Downlink dual carrier with 64 QAM; up to 42 Mbps CDMA air interface

 1x 153.6 kbps forward link, 153.6 kbps reverse link

 1xEV-DOr0 High-speed peak data rates 2.4 Mbps forward link; 153 kbps reverse link

 1xEV-DOrA High-speed peak data rates 3.1 Mbps forward link; 1.8 Mbps reverse link 6 COMPANY CONFIDENTIAL

 1xEV-DOrB High-speed peak data rates 14.7 Mbps forward link; 5.4 Mbps reverse link GSM / GPRS / EDGE air interface

 R99 Circuit-switched data: 9.6 k; 14.4 k

 GPRS Packet-switched data:

DTM (simple class A) operation Multi-slot class 12 data services CS schemes CS1, CS2, CS3, and CS4 GEA1, GEA2, and GEA3 ciphering Maximum of four Rx timeslots per frame

 EDGE E2 power class for 8 PSK DTM (simple class A), multislot class 12 Downlink coding schemes CS 1-4, MCS 1-9 Uplink coding schemes CS 1-4, MCS 1-9 BEP reporting SRB loopback and test mode B 8-bit and 11-bit RACH PBCCH support One-phase/two-phase access procedures Link adaptation and IR NACC, extended UL TBF GNSS

 GPS Standalone, MS-A, MS-B, and XTRA GPS

 Glonass GLONASS standalone mode GLONASS capability increases the number of satellites available to the positioning engine, resulting in an expanded area of coverage over traditional GPS receivers 7 COMPANY CONFIDENTIAL 1.2 System Block Diagram Figure 1-1 System block diagram Chipsets: MDM9615+WTR1605L+PM8018 8 COMPANY CONFIDENTIAL 1.3 Pin definition 1.3.1 Golden finger Pin sequence Figure 1-2 shows the sequence of pins on the 75-pin signal interface of M.2 3042. 1.3.2 Pin definition Table 1-1 M.2 Pin definition No. 1 2 3 4 5 6 M.2 Pin name CONFIG_3 I/O Description O Connected to Ground internally. Platform connection Refer to section 1.4.1 Configuration Pins 3.3V GND 3.3V GND Full_Card_Power_Off

(0/1.8V) PI Power supply (3.3V+/-5%) Refer to section 1.4.2 PI Ground Power and ground Refer to section 1.4.2 Power and ground PI Power supply (3.3V+/-5%) Refer to section 1.4.2 Power and ground Refer to section 1.4.2 Power and ground Refer to section 1.4.3 Full_Card_Power_Off PI Ground I When it is Low, M.2 card powers off. When it is High, M.2 card powers on. Pull down on card, should be tolerant of 3.3V 9 COMPANY CONFIDENTIAL 7 8 USB_D+

W_DISABLE#1

(0/3.3V) 9 USB_D-

10 LED#1 11 GND 12~19 Notch 20 AUDIO_0 IO USB Data+ defined in the I USB 2.0 Specification. Active low signal used by the host to turn on/off radio operation. When it is Low, radio off. When it is High, radio on. IO USB Data- defined in the USB 2.0 Specification. O Active low signal, used to allow the M.2 card to provide status indicators via LED devices that will be provided by the system. PI Ground

Notch Dont need to connect to platform;

Connect to MDM9xxx PRIM_PCM_CLK CONFIG_0 O Not connect internally. AUDIO_1

Dont need to connect to platform;

Connect to MDM9xxx PRIM_PCM_SYNC WoWWAN (0/1.8V) O WWAN to wake up the 21 22 23 24 AUDIO_2 25 DPR (0/1.8V) 26 W_Disable2

I I host, It is active low. Dont need to connect to platform;

Connect to MDM9xxx PRIM_PCM_DIN Hardware pin for BodySAR Detection H: No TX power backoff

(default) L: TX power backoff GPS disable:

H:Turn on GPS/GLONASS (default) L: Turn off GPS/GLONASS Refer to section 1.4.4 USB interface Refer to section 1.4.5 W_DISABLE#

Refer to section 1.4.4 USB interface Refer to section 1.4.6 LED Indication Refer to section 1.4.2 Power and ground Reserve for future extension, please contact with us if need to use these Pins Refer to section 1.4.1 Configuration Pins Reserve for future extension, please contact with us if need to use these Pins Refer to section 1.4.7 WoWWAN Reserve for future extension, please contact with us if need to use these Pins Refer to 1.4.8 DPR Refer to section 1.4.5 W_DISABLE#

27 28 GND PI Ground AUDIO_3

Dont need to connect to platform;

Refer to section 1.4.2 Power and ground Reserve for future extension, please contact 10 COMPANY CONFIDENTIAL 29 SSIC-TxN

Connect to MDM9xxx PRIM_PCM_DOUT Dont need to connect to platform;

Connect to MDM9xxx SPI_MOSI 30 31 32 33 34 35 36 37 38 39 40 UIM-RESET O UIM-RESET SSIC-TxP

Dont need to connect to platform;

Connect to MDM9xxx SPI_MISO UIM-CLK O UIM-CLK GND PI Ground UIM-DATA IO UIM-DATA SSIC-RxN UIM-PWR

Dont need to connect to platform;

Connect to MDM9xxx SPI_CS_N O UIM-PWR SSIC-RxP

Dont need to connect to platform;

Connect to MDM9xxx SPI_CLK Not connect

PI Ground N/C GND GNSS_SCL (0/1.8V*) IO I2C_CLK, Dont need to connect to platform 41 NC 42 GNSS_SDA

(0/1.8V*) 43 NC

IO

44 GNSS_IRQ (0/1.8V*) IO Dont need to connect to platform;

Connect to MDM9xxx UART_CTS_N I2C_DATA, Dont need to connect to platform Dont need to connect to platform;

Connect to MDM9xxx UART_RFR_N I2C_IRQ, Dont need to 11 with us if need to use these Pins Reserve for future extension, please contact with us if need to use these Pins Refer to section 1.4.9 USIM Reserve for future extension, please contact with us if need to use these Pins Refer to section 1.4.9 USIM Refer to section 1.4.2 Power and ground Refer to section 1.4.9 USIM Reserve for future extension, please contact with us if need to use these Pins Refer to section 1.4.9 USIM Reserve for future extension, please contact with us if need to use these Pins N/A for WWAN Refer to section 1.4.2 Power and ground Reserve for future extension, please contact with us if need to use these Pins Reserve for future extension, please contact with us if need to use these Pins Reserve for future extension, please contact with us if need to use these Pins Reserve for future extension, please contact with us if need to use these Pins Reserve for future COMPANY CONFIDENTIAL 45 46 connect to platform GND PI Ground SYSCLK (0/1.8V*) IO Dont need to connect to 47 NC 48 TX_BLANKING 49 NC 50 51 52 53 54 NC GND NC NC NC 55 56 NC NC GND NC 57 58 59 60 COEX3 (0/1.8V) 61 ANTCTL1 (0/1.8V)

platform;

Connect to PMIC XO Dont need to connect to platform;

Connect to MDM9xxx MDM_UART_TX Dont need to connect to platform;

Dont need to connect to platform;

Connect to MDM9xxx MDM_UART_RX Not connect

PI Ground

Not connect Not connect Dont need to connect to platform;

Connect to MDM9xxx GPIO# internally Not connect Dont need to connect to platform;

Connect to MDM9xxx GPIO# internally PI Ground

Dont need to connect to platform;

Connect to MDM9xxx GPIO# internally

signal, bit 0 For LTE/WLAN co-existence;

LTE_WLAN_PRIORITY O Tunable antenna control signal, bit 1 ANTCTL0 (0/1.8V) O Tunable antenna control 12 extension, please contact with us if need to use these Pins Refer to section 1.4.2 Power and ground Reserve for future extension, please contact with us if need to use these Pins Reserve for future extension, please contact with us if need to use these Pins Reserve for future extension, please contact with us if need to use these Pins Reserve for future extension, please contact with us if need to use these Pins N/A for WWAN Refer to section 1.4.2 Power and ground N/A for WWAN N/A for WWAN Foxconn use internally to separate different SKus N/A for WWAN Foxconn use internally to separate different SKus Refer to section 1.4.2 Power and ground Foxconn use internally to separate different SKus Refer to section 1.4.10 Antenna Control Refer to section 1.4.11 Coexistence Refer to section 1.4.10 Antenna Control 62 63 64 65 66 67 68 69 70 71 72 73 74 75 COMPANY CONFIDENTIAL COEX2 (0/1.8V)

For LTE/WLAN co-existence;

LTE_FRAME_SYNC ANTCTL2 (0/1.8V) O Tunable antenna control COEX1 (0/1.8V)

signal, bit 2 For LTE/WLAN co-existence;

LTE_ACTIVE ANTCTL3 (0/1.8V) O Tunable antenna control SIM Detect Reset# (0/1.8V) SUSCLK(32kHz)

(0/3.3V) signal, bit 3 SIM_SWP System reset Reserve I I I CONFIG_1 O Connected to Ground internally. Refer to section 1.4.11 Coexistence Refer to section 1.4.10 Antenna Control Refer to section 1.4.11 Coexistence Refer to section 1.4.10 Antenna Control Refer to section 1.4.9 USIM Refer to section 1.4.12 RESET#

Qualcomm MDM9xxx solution dont need external SUSCLK Refer to section 1.4.1 Configuration Pins 3.3Vaux PI Power supply (3.3V+/-5%) Refer to section 1.4.2 GND PI Ground Power and ground Refer to section 1.4.2 Power and ground 3.3Vaux PI Power supply (3.3V+/-5%) Refer to section 1.4.2 GND PI Ground Power and ground Refer to section 1.4.2 Power and ground 3.3Vaux PI Power supply (3.3V+/-5%) Refer to section 1.4.2 CONFIG_2 O Connected to Ground internally. Power and ground Refer to section 1.4.1 Configuration Pins 13 COMPANY CONFIDENTIAL 1.4 Platform connection design 1.4.1 Configuration Pins The M.2 module provides 4 configuration pins. T77H468 is configured as WWAN-SSIC 0, refer to PCIe M.2_Rev0.7a. Item Config Config_0 Config_1 Config_2 Config_3 Pin No. Module configuration decodes 69 75 1 Module type Port configuration WWAN-SSIC 0 GND GND GND 21 NC State 1.4.2 Power and ground

(1) Power Rail Parameters Max Parameter Operating voltage 3.465 The operating voltage was defined in PCIe M.2_Rev0.7a standard as 3.3V+/-5%. Min 3.135 Type 3.3 Units Vdc

(2) 3.135 V is the minimum voltage supplied to LTE M.2 card by the host platform, and VCC must never be under 3.135 V in any case. As our experiment, if we set the VCC=3.0V, the M.2 card will power off when M.2 card working at +23dBm continue mode.

(3) Whenever the M.2 module works at 2G mode, the module transmits at the maximum power (like +33dBm), the transient peak current may reach to 2.5 A. We recommended design the VCC supply of host as below:

Remark: When the system power restarts, reserve R1 to discharge power.

(4) The LTE M.2 module provides 5 power pins and 11 Ground pins. To ensure that the LTE module works normally, all the pins must be connected. 14 1.4.3 Full_Card_Power_Off COMPANY CONFIDENTIAL The M.2 LTE module can be controlled to power on/off by the Full_Card_Power_Of pin. Item 1 2 M.2 card state Powers off, Its internally pulled down by 100K ohm resistor Powers on, it is 3.3V tolerant but can be driven by either 1.8V or 3.3V GPIO. State Low High The recommended connections as below 1.4.4 USB interface T77H468 module is compliant with USB2.0 in all three modes (Low speed, Full speed, and high speed). When two devices are connected via a USB interface, one of the devices must act as a host, and the other device must act as a peripheral. The host is responsible for initiating and controlling traffic on the bus. Figure 1-4-4 USB2.0 interface 15 1.4.5 W_DISABLE#

COMPANY CONFIDENTIAL This control setting is implementation-specific and represents the collective intention of the host software to manage radio operation. T77H468 provides a hardware pin (W_DISABLE#) to disable or enable the radio. Besides, the radio can also be enabled or disabled through software AT commands. Item W_DISABLE#1 W_DISABLE#2 Function (WWAN state) State Low WWAN Disabled (no RF operation allowed) High Low High WWAN Enabled (RF operation allowed), internally pull up GPS Disabled (no RF operation allowed) GPS Enabled (RF operation allowed), internally pull up 1.4.6 LED Indication The LED signal is provided to enable wireless communication add-in cards to provide status indications to users via system provided indicators

(1) State of the LED# pin Definition Item 1 The LED is emitting light. 2 The LED is emitting no light. Radio is incapable of transmitting. Interpretation Radio is capable of transmitting. State Low High

(2) Typical LED Connection in Platform/System

. 16 COMPANY CONFIDENTIAL 1.4.7 WoWWAN The WAKE_ON_WWAN# signal is for power saving. LTE module always listening at very low power in idle mode LTE module will wake up mother board via WoWWAN signal. The platform will power on when triggered by the LTE module. The WAKE_ON_WWAN# signal is used to wake up the host. It is open drain and should be pulled up at the host side. When the WWAN needs to wake up the host, it will output a one second low pulse, shown in Figure 1-4-6. Typical Connection in Platform/System 17 COMPANY CONFIDENTIAL 1.4.8 DPR (Dynamic Power Reduction) The optional DPR signal is used by wireless devices to assist in meeting regulatory SAR

(Specific Absorption Rate) requirements for RF exposure. The signal is provided by a host system proximity sensor to the wireless device to provide an input trigger causing a reduction in the radio transmit output power. The required value of the power reduction will vary between different host systems and is left to the host platform OEM and card vendor to determine, along with the specific implementation details. The assertion and de-assertion of DPR is asynchronous to any system clock. All transients resulting from the proximity sensor need to be de-bounced by system circuitry.

(1) State of the PDR Item 1 2 State Low High Definition Enable the SAR power back off. Radio is capable of transmitting. Disable the SAR power back off, internally pull up Radio is incapable of transmitting. Interpretation

(2) Typical Connection in Platform/System Remark:

a. The proximity sensor was controlled by the platform side. b. After PDR pin becomes low level, you can set the MAX TX power by AT commands. 18 1.4.9 USIM COMPANY CONFIDENTIAL The UIM contains parameters necessary for the WWAN devices operation in a wireless wide area network radio environment. The UIM signals are described in the following paragraphs for M.2 add-in cards that support the off-card UIM interface.

(1) USIM card socket It is recommended to take electrostatic discharge (ESD) protection measures near the USIM card socket. The USIM socket should be placed near the NGFF interface (<100 mm), because a long circuit may impact signal quality.

(2) UIM-PWR UIM_PWR power supply can supply 1.8 V and 2.85 V power to UIM card and auto detects follow SIM card type

(3) SIM Detect This signal is used to detect the insertion and removal of a SIM device in the SIM socket. With a Normal Short SIM Card connector, PUSH-PUSH type, the detect switch is normally shorted to ground when no SIM card is inserted. When the SIM is inserted, the SIM_DETECT will transition from logic 0 to logic 1 state. The rising edge will indicate insertion of the SIM card. When the SIM is pulled out, the SIM_DETECT will transition from logic1 to logic 0. This falling edge will indicates the pulling out of the SIM card. The M.2 module monitoring this signal will treat the rising/falling edge or the actual logic state as an interrupt, that when triggered, the module will act accordingly. 19 1.4.10 Antenna Control COMPANY CONFIDENTIAL T77H468 provides GPIO control signals for external antenna tuner application. The function is under development for customization. ANTCTRL (0-3) are provided to allow for the implementation of antenna tuning solutions. The number antenna control lines required will depend on the application and antenna/band requirements. An example of tuning state configuration as below. ANTCTL0 0 0 ANTCTL2 0 0 ANTCTL1 0 1 1 1 0 0 1 1 0 0 1 1 0 0 1 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 0 0 0 0 0 1 1 1 1 1 1 1 1 ANTCTL3 0 0 0 0 1 1 1 1 0 0 0 0 1 1 1 1 Band support LTE BAND XVII, XIII LTE BAND V UMTS BAND VIII, V, GSM 850/900 LTE Band XXV, IV, II UMTS BAND IV, II, I GSM 1800/1900 1.4.11 Coexistence COEX1, COEX2 and COEX3 are provided to allow for the implementation of wireless coexistence solutions between the radio(s) on the M.2 Card and other off-card radio(s). These other radios can be located on another M.2 Card located in the same host platform or as alternate radio implementations (for example, using a PCI Express M.2 CEM or a proprietary form-factor add-in solution). Reserve for future extension, please contact with us if need to use these Pins. Item COEX1 COEX2 COEX3 Signal name LTE_ACTIVE LTE_FRAME_SYNC LTE_WLAN_PRIORITY GPIO from MDM9x15 GPIO_67 GPIO_66 GPIO_65 Description TBD TBD TBD 20 COMPANY CONFIDENTIAL 1.4.12 RESET#

Asynchronous RESET# pin, active low. Whenever this pin is active, the modem will immediately be placed in a Power On reset condition. Care should be taken not to activate this pin unless there is a critical failure and all other methods of regaining control and/or communication with the WWAN sub-system have failed. The Reset# signal is relatively sensitive, it is recommended to install one capacitor

(10~100pF) near to the M.2 card pin. 21 COMPANY CONFIDENTIAL 2. Hardware features T77H468 consists of the following key engine components, in addition to the required front-end RF and other discrete components. Modem engine Soft Baseband: MDM-9615 RF: WTR1605L Power: PM8018 Connectivity engine USB: USB2.0 high-speed USIM: located off board Antenna: connectors for the off board antennas 2.1 Mobile Data Modem The MDM9615 chipset solution integrates powerful digital signal processors (DXPs) into any market-proven wireless modem, offering increased processing capacity and lower power consumption. They are complete system solutions that operate on networks worldwide. The major functions of MDM9615 used on T77H468 are listed below:

Processor:

- Manufactured in 28nm CMOS process

- System uP (Cortex-A5+L2 cache at up to 550MHz)

- ARM7 processor for the RPM Memory:

- External memory (16KB for security) EBI1: 1Gb LPDDR1

- External memory EBI2: 2Gb NAND flash Air interface:

- WCDMA (R99, HSDPA, HSUPA, HSPA+, DC-HSPA+)

- CDMA (1x, EV-DOr0, EV-DOrA, EV-DOrB)

- LTE (R9 Cat3, FDD)

- GSM (GSM R99, GPRS, EDGE)

- GPS/Glonass Advance RX operation:

- Mobile receive diversity (WCDMA, CDMA and LTE) 22 COMPANY CONFIDENTIAL Connectivity:

- USB 2.0 HS with built-in USB PHY

- UART interface

- UIM support (dual voltage) 2.2 RF transceiver The WTR1605 device is a highly integrated and versatile RF CMOS transceiver IC that can be used in multimode, multiband applications including Rx diversity. The WTR1605 IC is the RF transceiver IC within compatible Qualcomm MDM9615 chipsets. The WTR1605 IC integrates advanced receive and transmit features into a 4.91 5.47 0.63 mm package to simplify handset design, minimize parts count, and reduce DC power consumption. These advanced Rx/Tx features include:

 Multimode, multiband RF transceiver functions:

 GNSS receiver functions

 Fully integrated LO generation and distribution circuits to support all the RF operating band and mode combinations

 Primary, diversity, and GNSS receivers that can operate simultaneously

 Tx power detector for monitoring the transmit power levels

 The GSM receiver can share the secondary paths with CDMA, WCDMA, and LTE diversity receivers

 Qualcomms intelligent receiver technology for CDMA modes:

 Low operating voltages that help save battery current and allows the WTR IC power to be supplied by the PMICs switching mode power supply (SMPS) circuits for even greater power savings 2.3 Power management IC T77H468 system uses the Qualcomm PM8018. Qualcomm has worked with Maxim Integrated Products Inc. to develop a custom PMIC solution for use with the T77H468 platform. 23 COMPANY CONFIDENTIAL 2.4 Antenna Design 2.4.1 Antenna specification T77H468 also provides connectivity for off board antennas. The antennas and their connection interface for this device satisfy the requirements specified in the PCI Express M.2 Specification Revision 0.7a, Version 1.0 standard. The antenna elements are typically integrated into the notebook/ultrabook /tablet and connected to T77H468 module via flexible RF coaxial cables. T77H468 provides two RF connectors (MHF type), one for the primary transmitter/receiver port and the other for the diversity receiver and GNSS. To ensure stable RF performance, customer must assemble adequate antenna according to the antenna specification. Table 2-1 Main antenna specifications Max. 0.5 Parameter Min. Typ. Cable loss Impedance

50

2:1 VSWR Units dB ohm

Notes Maximum loss to antenna Antenna load impedance Maximum allowed VSWR of antenna Table 2-2 Aux antenna specifications Parameter Gain Average 3D gain VSWR Isolation(diversity to Main) Polarization Maximum gain and uniform converge in high angle elevation and zenith. Gain in the azimuth is not desired.

>-5dBi Typical value <2:1

>10dB in all related bands Any 2.4.2 Antenna location and mechanical design. To ensure customer has a clear knowledge of the two antennas, check below product picture. Figure 2-1 Antenna connector location and type 24 Figure 2-2 RF connectors COMPANY CONFIDENTIAL 25 COMPANY CONFIDENTIAL Figure 2-3 RF receptacles 26 COMPANY CONFIDENTIAL 3. Mechanical Specifications 3.1 Overview T77H468 is compatible with the PCI Express M.2 Specification 3042 type 75-pin card edge-type connector. Refer to Electromechanical Specification Revision 0.7a, Version 1.0 with Input Power and Voltage Tolerance ECN for more details. 3.2 Mechanical constraints Figure 3-1 shows the mechanical constraints of T77H468 (3042-S3-B) 27 COMPANY CONFIDENTIAL 3.3 M.2 card assembly Figure 3-2 shows Stack-up Mid-Line (In-line) Single Sided Module for 1.5 Maximum Component Height, refer to section 2.4.8.3.1 of PCIe M.2_Rev0.7a standard. Remark:

a. 2.4mm maximum above mother board b. Cut area of main board under M.2 module c. Need to add thermal pad between M.2 module and mechanical component (like material shielding) for thermal dissipation. 28 COMPANY CONFIDENTIAL 4. Electrical Specifications 4.1 Recommended operating conditions Table 4-1 Recommended operating conditions Parameter Storage temperature Recommend operating temperature Extend operating temperature Operating voltage Min

-30

-10

-20 3.135 Type

+25

+25

+25 3.3 Max

+85

+60

+75 3.465 Units C C C Vdc Operating T77H468 device under conditions beyond its absolute maximum ratings (Table 4-1) may damage the device. Absolute maximum ratings are limiting values to be considered individually when all other parameters are within their specified operating ranges. Functional operation and specification compliance under any absolute maximum condition, or after exposure to any of these conditions, is not guaranteed or implied. Exposure may affect device reliability 4.2 Power consumption Table 4-2 Radio system power consumption Test condition Estimated power range goal GSM in standby mode GSM (Tx=31dBm) WCDMA in standby mode WCDMA (Tx=24dBm) CDMA in standby mode CDMA (Tx=24dBm) LTE in standby mode LTE (64QAM) Tx=23 dBm GPS tracking Glonass tracking, high sensitivity

<5mA

<500mA

<5mA

<900mA

<5mA

<900mA

<5mA

<900mA

<200mA

<260mA Remark: Above specification is our target, we are working on current consumption optimization, we will update after finish current consumption measurement. 29 COMPANY CONFIDENTIAL 5. RF performance specifications Radio performance for T77H468 is given in the following sections, including RF receiver, RF transmitter. 5.1 RF maximum Tx power specifications Table 5-1 Maximum transmit power Specification LTE (B2) LTE (B4) LTE (B5) LTE (B13) LTE (B17) LTE (B25) WCDMA (B1) WCDMA (B2) WCDMA (B4) WCDMA (B5) WCDMA (B8) CDMA (BC0) CDMA (BC1) GSM850/900 GSM1800/1900 GPRS 850/900 GPRS 1800/1900 EDGE 850/900 EDGE 1800/1900 Remark:

Power class/

control level Class 3 Class 3 Class 3 Class 3 Class 3 Class 3 Class 3 Class 3 Class 3 Class 3 Class 3 Class 3 Class 2 Level 5 Level 0 Level 5 Level 0 Level 8 Level 2 Min. 21 21 21 21 21 21 21 21 21 21 21 23 23 31 28 31 28 25 24 Typ. 23 23 23 23 23 23 24 24 24 24 24 24 24 33 30 33 30 27 26 Max. 25 25 25 25 25 25 25 25 25 25 25 30 30 35 32 35 32 29 28 unit dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm Above table is for general application, please inform us if you have any further requirement. 30 COMPANY CONFIDENTIAL 5.2 RF min. Rx sensitivity specifications Table 5-2 Conducted min. receiver sensitivity Specification Min. Typ. Max.

(compliance with standard) LTE (B2)@10MHz LTE (B4) @10MHz LTE (B5) @10MHz LTE (B13) @10MHz LTE (B17) @10MHz LTE (B25) @10MHz WCDMA (B1) WCDMA (B2) WCDMA (B4) WCDMA (B5) WCDMA (B8) CDMA (BC0) CDMA (BC1) GSM850/900 GSM1800/1900 GPRS 850/900 (CS1) GPRS 1800/1900 (CS1) EDGE 850/900 (CS5) EDGE 1800/1900 (CS5) GPS/GLONASS tracking sensitivity

-98.5

-100

-100

-100

-100

-98.5

-111

-111

-112

-113

-113

-110

-110

-112

-110

-112

-110

-106

-104

-157

-95

-97

-95

-94

-94

-93.5

-106

-104

-106

-104

-103

-105.5

-105.5

-102

-102

-102

-102

-99

-99

-152 Remark: It has 3dB margin at least refer to 3GPP standard or CDMA standard. unit dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm dBm 31 COMPANY CONFIDENTIAL 6. Software Requirements The software includes firmware, driver, configuration file and configuration utility for LTE Card based on Qualcomm MDM9615+WTR1605L chipsets. Please refer to main features in below table.

1.1 1.1.1 1.1.2 1.1.3 1.1.4 1.1.5 1.1.6 1.1.7 1.1.8 1.1.9 1.1.10 1.1.11 1.1.12 1.1.13 1.1.14 1.1.15 1.1.16 1.1.17 1.1.18 1.1.19 1.1.20 Feature Modem LTE-FDD - Release 8 LTE-FDD - Release 9

(mandatory features) DC-HSPA+ - Release 8 1x Advanced EVDO Rev B eHRPD WCDMA GERAN SVLTE WCDMA/GERAN:

Protocols Rel-8:

Support for E-UTRA Detection LTE-eHRPD Mobility Rel8 Fast Dormancy Rel7 HSPA DTX/DRX APT - for all modes (LTE FDD/WCDMA, C2K) Peripheral attachments -

WLAN for QCMobileAP and SD card Data call (Geran, WCDMA, 1X/EVDO, eHRPD and LTE) SMS (GERAN, WCDMA,1X/EVDO, eHRPD and LTE) Data interface- QMI Power grid /PAM table config support Support for Gobi RF configs Feature description If LTE coverage is available and if UE is able to detect the same (from a state where we didnt have any sync LTE cells), it will inform upper layers. This is spec requirement QMI commands for UQCN download and selection. Add commands to manage UQCNs, set the device in Download mode. Support for Gobi WTR1605 configurations 32 COMPANY CONFIDENTIAL 1.1.21 1.1.22 1.1.23 1.1.24 1.1.25 1.1.26 UQCN Feature support Configurable RRC band scan order, also add support for LTE cfgs Saving MRU/ Band scan etc. info while in suspend/resume/power-s ave states - WCDMA Gobi - Saving MRU/band scan info (3GPP2) Gobi - Saving MRU/band scan info (GERAN, WCDMA) Gobi - Add QMI CAT Command for terminal profile property. 1.1.27 Multiple carrier support in NV 1.2 1.2.1 1.2.2 1.2.3 1.3 1.3.1 1.3.2 Modem (1X) Enable complete IS-683C OTA message support OTASP support for all band classes Multimode:

OTASP/OTAPA Runtime Detection of OTASP Numbers Modem (EVDO) Dedicated Data Transfer Mode (DDTM) EV-DO Data Activity Based Adaptive Receive Diversity UQCN Feature support

,Carrier specific UQCNs implementation / UQCN generation tools Add QMI_CAT_SEND_ENVELOP_CMD_RSP. Add optional TLV in QMI_CAT_SEND_ENVELOP_CMD_RSP to report envelope response from card in raw format and corresponding status words Provides the ability for a single modem image to support multiple carriers via per-carrier configuration files that are downloaded to the modem. This is a Gobi modem capability FEATURE_IS683C_OTASP makes the following messages compliant with IS683C standard:

 Protocol Capability Response message

 SSPR Configuration Request/Response message Expand the OTASP support to all the bands supported by the 3GPP2 C.S0057-B Provide capability of using custom numbers with OTASP calls via UI through Centralized Call Control support Allows the user to control the 1X access at runtime when the 1xEV-DO data call is made Disable EV-DO diversity when no FL data is arriving. When data resumes, immediately bring up diversity. This saves power during the period of waiting for dormancy for applications that don't explicitly close the connect 33 COMPANY CONFIDENTIAL Rx Diversity during 1x Access Enable 1x Rx Diversity during 1x Access if Rx Diversity for Traffic Has Been Enabled 1.3.3 1.3.4 1.3.5 1.3.6 1.3.7 1.4 1.4.1 1.4.2 1.5 1.5.1 1.5.2 1X EV-DO Rev B (with QOS for handsets) 3 Carrier Rev B over 5x Bandwidth Max Bandwidth Support Rev B physical layer FL rates Modem (eHRPD) eHRPD: eHRPD <-> 1x handoff eHRPD: eHRPD <->

HRPD handoff Modem (Geran) GERAN 3GPP Rel-8 Spec compliance NACC, Ext UL TBF Rel 1.2.3 PFC/PFI 1.5.4 1.5.5 1.5.6 1.5.7 EDGE MSC12 GPRS/EDGE MSC12-EDA Enh DL RLC/MAC Segmentation Enhanced Ext UL TBF 1.5.8 2G PS handover 1.5.9 Encryption: GEA3 The multi-carrier version of 1xEV-DO in which up to three carriers are supported on the forward and reverse links; QoS added for handsets 3 Carrier rev B over 5x bandwidth Support calls where the AN assigns outer carriers that are 5.16 MHz apart Enhanced flow rates on FL Allows the mobile to move between areas of eHRPD coverage and 1x coverage (and vice-versa). When moving from 1x/HRPD to eHRPD, AT should not send ULN. When moving back from eHRPD to HRPD, also AT should not send ULN. GERAN compliant with Rel-8 spec versions Network-Assisted Cell Selection for faster cell reselection and Extended UL TBF Release to extend the UL TBF and reduce the incidence of idle activity between packet transfer activities Packet Flow Context/Packet Flow Identifier -

Allows identity tagging of RLC blocks to identify separate QoS streams at the radio link layer Original legacy EDGE support with Multislot Class 12 capability Extended Dynamic Allocation to permit allocation of more than two uplink timeslots for GPRS/EDGE Permits reception of MAC control messages that exceed one radio block capacity in length Per Ext UL TBF, with the addition that dummy block transmission is punctured for current saving purposes Packet-switched equivalent of CS handover to ensure faster cell change and improved throughput New packet-switched cipher algorithm 34 COMPANY CONFIDENTIAL 1.5.10 1.5.11 1.5.12 WCDMA/GERAN: Band Scan Run-time Configurable RRC Band Scan Order WCDMA/GERAN: Power and Network Optimizations Frame Early Termination for Power Optimization WCDMA/GERAN:

Protocols MRAB-Pack-1 Enhancements 1.6 1.6.1 1.6.2 1.6.3 1.6.4 1.6.5 1.6.6 1.6.7 Modem (UMTS) Cat 10 HSDPA Cat 6 HSUPA Cat 14 HSPA+

DC-HSPA+

HSUPA 10ms TTI (2 Mbps) HSUPA 2ms TTI (5.76 Mbps) E-FDPCH 1.6.8 Enhanced L2 Run-time configurable RRC band scan order With pragmatic reception approach, decode partial TTI and terminate frame early to reduce power consumption These UE enhancements will reduce Multi-RAB Call Drops. The following optimizations are planned under MRAB-Pack-1: 1) Configuration of the minimum set of TFCs: Optimize the way that PS-only TFCs are selected for UL transmission in power limited conditions(2 flavors) 1-EUL) Smart application of minimum E-TFCI : Optimize utilization of Minimum E-TFCI in power limited conditions 4) MRAB Back-off: Preventing, or reducing the establishment of data connections on top of existing voice connections in power limited conditions 6) TVM Back-off : Blocking traffic volume events (Event 4a) for MRAB calls in power limited conditions Rel-5 Category 10 HSDPA, allowing for physical layer throughputs up to 14.4 Mbps. Rel-6 Category 6 HSUPA, allowing for physical layer throughputs up to 5.76 Mbps. Cat 14 HSPA+ 64-QAM HSDPA, allowing for physical layer throughputs up to 21 Mbps Dual Carrier HSPA+, allowing for physical layer throughputs up to 42 Mbps HSUPA 10 ms TTI up to 2 Mbps in UL physical layer HSUPA 2ms TTI up to 5.76 Mbps in UL physical layer E-FDPCH Rel-7 enhancement to the Rel-6 FDPCH (fractional DPCH) in soft handover scenarios; fractional DPCH was added in Rel-6 to optimize the consumption of downlink channelization codes - Allowing more users to share the channel Support for flexible sized PDUs at RLC DL and PDU segmentation at MAC-HS level, on the HSDPA downlink to allow for higher data rates in Rel-7 35 COMPANY CONFIDENTIAL 1.6.9 CPC-DTX 1.6.10 Q-ICE 1.6.11 SCH-IC 1.7 1.7.1 1.7.2 1.7.3 1.7.4 1.7.5 1.7.6 1.7.7 1.7.8 1.7.9 1.7.10 1.7.11 1.7.12 1.7.13 1.7.14 1.7.15 1.7.16 1.7.17 1.7.18 1.7.19 Modem (LTE) Rel-9: Mandatory LTE Features Bandwidth support 1.4, 3, 5, 10, 15, 20 MHz Standalone Security CMAS for LTE ETWS (Earthquake Tsunami Warning System) - LTE Intra-Freq Connected mode mobility Intra-Freq Idle mode mobility Inter-Freq mobility Connected mode DRX Sleep eHRPD -> LTE Idle mode reselection E-UTRA RRC_IDLE ->

eHRPD Idle IRAT SON ANR LTE -> eHRPD

(Redirections without measurement gaps -

blind) LTE -> eHRPD

(Redirections based on measurements gaps) LTE -> 1x Connected mode measurements LTE -> 1x Redirection LTE -> 1x Reselection UMTS -> LTE Redirections (no measurements) Allows for breaks in transmission during HSUPA for power consumption benefit and UL interference reduction. Advanced UMTS receiver performing iterative equalization and interference cancellation in support of HSPA+

Cancelling the interference from the synchronization channel for improved HSDPA performance Support for Release 9 Mandatory Features Per 3GPP standard NAS & RRC security for LTE Commercial Mobile Alert System for LTE Support for ETWS notification in LTE Support for 1X2 MISO (1Tx and 2Rx for two downlinks simultaneously) Support for 1X2 MISO (1Tx and 2Rx for two downlinks simultaneously) Mobility within LTE band/bandwidth Exercising DRX cycle while in LTE Connected mode Exercising DRX cycle while in LTE Idle mode Mobility from eHRPD to LTE in Idle mode based on LTE neighbor cell measurements Reselection from idle LTE to idle eHRPD UE IRAT support for Self Organizing Networks and Automatic Neighbor Relation Redirections from LTE connected -> eHRPD Idle without measurements (blind redirection) Redirections from LTE connected to eHRPD idle based on measurements during gaps intervals Perform measurements on 1x side during LTE Connected mode state. Redirection from LTE connected to 1x idle Idle mode reselection from LTE idle to 1x idle Redirection from UMTS to LTE (blind - no measurements) 36 1.7.20 1.7.21 1.7.22 1.7.23 1.7.24 1.7.25 1.7.26 1.7.27 1.7.28 1.8 1.8.1 1.8.2 1.8.3 1.8.4 1.8.5 1.8.6 COMPANY CONFIDENTIAL UMTS -> LTE Redirections (with measurements) GERAN -> LTE Redirections (no measurements) LTE <-> GERAN Idle mode mobility (cell reselection) LTE <-> UMTS Idle mode mobility (cell reselection) LTE -> UMTS PS Handover LTE -> UMTS Redirections (with measurements) 2012 LTE/GW Data Silent Redial for InterRAT Multimode: LTE Attach/Detach PS during Voice Call or SMS TDD-LTE Modem (System Determination) Frequency Scan and System Selection within LTE LTE BPLMN support LTE Connected mode OOS System Selection across LTE, UMTS, GERAN, 1x/DO System Selection across RATs, Standalone Security, Dedicated EPS Bearer Mgmt and Dormancy Support of 256 UPLMN and 256 OPLMN entries in USIM Redirection from UMTS Connected mode to LTE based on LTE measurements during WCDMA Compressed mode gaps Redirection from GERAN to LTE (blind - no measurements) Idle mode reselection from LTE idle to GERAN idle Idle mode reselection from LTE idle to UMTS idle UE does a PS handover under network direction from LTE to UMTS Redirection from LTE connected to UMTS with measurements on UMTS During inter RAT transitions between LTE and WCDMA/GPRS, data calls that are locally rejected on source RAT will be redialed by Data Services mode handler on target RAT Support disabling of PS capability during voice call/SMS and removing LTE when PS is removed (Detach) and add LTE again when PS is added (attach) Ability to do band scan and also power-up system selection Support for PLMN search in background while LTE is active Support System Operation mode (Online, LPM, POWER OFF, etc.) changes in LTE Connected and Idle mode Ability to select a particular RAT based on a preferred RAT list Standard LTE features UE can read 256 entries from each preferred list. Together, it can read a maximum of 512 PLMN entries from preferred list. 37 COMPANY CONFIDENTIAL 1.8.7 1.8.8 1.8.9 1.8.10 1.8.11 1.9 1.9.1 1.9.2 1.9.3 1.9.4 1.9.5 1.9.6 1.9.7 Multi-mode System Selection Multimode: System Selection Avoiding Unnecessary Attach Requests in A 3GPP+3GPP2 Multimode UE Carrier Specific BSR Requirements Data Services:

eHRPD/LTE Data System Determination for Multiple Radio Systems WCDMA/GERAN:

System Selection Prevent UE from Sending Attach Request Message Infinitely When HPLMN Reject Attach Request with Cause 14 Modem (Data) ATCOP WCDMA/GERAN:

ATCOP 3GPP Enhancing The Interface for Manual PLMN Selection IPHC DHCPv4 Simple IPv4 Mobile IPv4 4 PDNs Support over Multi-RmNet 1.9.8 Dual IP on single RmNet Facilitating system selection when UE supports multiple modes NAS will use a synchronous API call to check with CM whether a PLMN is ok to attach before starting attach procedure. If API returns TRUE, NAS will do the attaching and send SRV_CNF to CM. This will be a preferred system so CM wont send STOP_MODE for less preferred system. If API returns FALSE, CM_SRV_CNF with No Service Extensions to carrier specific set of requirements for System Selection Re-architect data call arbitration in Data Services layers to remove race conditions between various SW entities in modem and CNE If HPLMN rejects GPRS Registration with cause # GPRS Services Not Allowed in this PLMN (which it shouldn't as per expectation from a well-behaved network), UE keeps on attempting registration again and again on same HPLMN RA. This feature is to cover up for this network misbehavior and reattempt GPRS registration only on RA change Provide Manual PLMN Selection API between CM/NAS and ATCOP to provide the current serving status of the UE IP header compression protocol as RFC 2509 DHCPv4 This is to support for stateless DHCPv4 protocol to get P-CSCF and DNS addresses Supports IPv4 address allocation and release without IP mobility Provides the capability to an external AP to support 4 PDNs through 4 RmNet Connections to external processor UE shall support tethered RmNet to laptop data call using Dual IP on single RmNet to a single USB-end point 38 COMPANY CONFIDENTIAL 1.9.9 IP only Mode/Raw IP Mode 1.9.10 Multi-RmNet Data Call 1.9.11 1.9.12 1.9.13 1.10 1.10.1 1.10.2 1.11 1.11.1 1.11.2 1.11.3 1.11.4 DHCPv6 RmNet IPv6 Tethered IPv6 using DUN over USB Modem (Data: EVDO) RLP: 1x EVDO Rev B CDMA: 1X EVDO Rev B Enhanced PA Back off for DO Rev B Modem (Data: eHRPD) EAP-AKA' (prime) eHRPD: Multiple PDN Support eHRPD: Optimized Silent Redial and DCTM4.0 Data Services: eHRPD Ignore PDN Inactivity Timer for The Last PDN 1.12 1.12.1 Modem (Data: LTE) LTE: Data Call throttling LTE: Default IPv4 Bearer activation at attach LTE: NW initiated QoS LTE: UE initiated QoS Dual IP Continuity IPv4/IPv6 Continuity 1.12.2 1.12.3 1.12.4 1.12.5 1.12.6 RmNet laptop calls transfer IP packets over USB or shared memory without Ethernet framing; reduces CPU overhead and speeds up call setup times (no ARP duplicate detection) This is support multiple tethered data calls over multi-RmNet This is to support Radio Link Protocol in 1xEV-DO Rev B Uses Tx power differential based PA back off for multi-carrier assignment, and improves a) multi-carrier coverage/throughput on FL, and b) RL data rate/throughput when multiple carriers are assigned on FL Authentication protocol using AKA' (prime) over EAP transport for all air interfaces Enhanced AMSS implementation to support multiple VSNCP negotiations and multiple VSNP data paths over one PPP instance for eHRPD multiple PDN connectivity; 3GPP2 eHRPD specification

(X.P0057-0-EHRPD-EUTRAN) Silent Redial of data call on eHRPD system The UE shall ignore the PDN Inactivity timer when only one PDN connection remains. Upon PDN Inactivity timer expiry, if it is the last PDN connection, the UE shall extend the timer, and shall not initiate PDN disconnection This is to prevent UE from repeatedly requesting PDN connections to the NW when it encounters a failure in either eHRPD or LTE connections Support for IPv4 data call in LTE Dual IP continuity across LTE and eHRPD Dual IP continuity across LTE and eHRPD 39 1.12.7 1.12.8 1.12.9 1.12.10 1.12.11 1.12.12 1.12.13 1.12.14 1.12.15 1.12.16 1.13 1.13.1 1.13.2 1.13.3 COMPANY CONFIDENTIAL LTE-eHRPD mobility:

IPV4 Session Continuity LTE-eHRPD mobility:

IPV6 Session Continuity LTE: W/G IP session Continuity LTE: MIMO LTE TDD 4-Port Processing LTE: MBMS LTE TDD MBSFN Awareness LTE: Mobility LTE TDD Inter-Freq Connected Mode Handover LTE: DRX LTE TDD Connected Mode DRX without Sleep LTE: DRX LTE TDD Connected Mode DRX with Sleep LTE: Emergency Services LTE NAS Support for Control Plane LTE Positioning Protocol Data Services LTE-eHRPD Mobility Support of APN Class and APN Bearer in Application Profile over LTE Modem (VoLTE) LTE: VoLTE Forking Support LTE: QMI VoLTE: QMI Indication for Remote Party on Hold LTE: VoLTE Session Timer support on VoLTE IPv4 session continuity across LTE and eHRPD IPv4 session continuity across LTE and eHRPD IP session continuity across LTE and W/G LTE TDD 4x2 MIMO antenna configuration support (4x2 transmit diversity) Ability to ignore MBSFN symbols in LTE TDD subframes while maintaining unicast performance LTE TDD inter-frequency connected mode handover with measurements covering multiple EARFCN's in the same or different bands as well as different bandwidths in the same EARFCN Improve power consumption by turning off modem/RF components during connected mode DRX periods. No Sleep support Enhanced and optimized power consumption over 1.12.13 using sleep support in Connected mode DRX periods Enable Location Positioning Protocol capabilities through NAS signaling as well as to create an API providing transport services for GPS signaling To support APN Bearer in Application Profile over LTE Support for parallel and sequential forking in IMS VoLTE Indication provided when remote party places call on hold Session Timer Support on VoLTE/QIPCall to be implemented/tested for Phase3 40 COMPANY CONFIDENTIAL 1.13.4 LTE: VoLTE VT Call Supplementary Services 1.13.5 1.13.6 LTE: VoLTE Early Media Support LTE: VoLTE VoLTE Support in RIL, Android Telephony and QMI_VOICE Support for VT call supplementary services:

1. Call Hold/Resume 2. Call waiting a. Between two VT/VS calls b. Between VT/VS call and VOIP call c. Between VT/VS call and 1x call 3. Call conference 4. Caller id Presentation/Restriction5. DTMF Support for early media in VoLTE VoLTE support in RIL, Android Telephony and QMI_VOICE The Linux features described in this chapter are:

 Device Drivers

 Modem Interface

 Linux Kernel and BSP

 Other

 Power Management

 USB

 Validated Configuration

 Development/Debug Table 5-1 Linux features

2.1 2.1.1 Feature Device Drivers UART Driver 2.1.2 I2C Driver 2.1.3 I2S Driver 2.1.4 SD/MMC Interface 41 Feature description Peripheral driver for Universal Asynchronous Receiver/Transmitter Peripheral driver for Inter-IC bus up to 100 kbps or 400 kbps for Fast mode Peripheral driver for Inter-IC sound bus. I2S is an industry standard (invented by Philips) three-wire interface for streaming stereo audio between devices. Typical applications include digital audio transfer between a CPU/DSP and a DAC/ADC. The I2S core allows a Wishbone master to stream stereo audio to and from I2S capable devices. Secure digital memory support. 2.1.5 SDIO COMPANY CONFIDENTIAL Secure digital input/output

 Two controller ports

 Up to 48 MHz

 4-bit interface

Interface through Linux MMC stack Support for wireless networking over SDIO Peripheral driver for Serial Peripheral Interface bus can use Data Mover and clock up to 26 MHz Driver for SSBI (Single-Wire Serial Bus Interface) bus hardware cores Flash driver support for 8-bit and 16-bit Single Level Cell (SLC) NAND devices with 2k page size Support for AT commands required for GCF testing. See document 80-VR432-1 for details. Support for tethered dial-up networking over USB QMI is to be used by 3rd party operating systems to configure the modem data stack Adding a field to know whether the record is read only or read-write in QMI_PBM_RECORD_READ_IND. This is required instead of determining through UIM for this information. This feature tells the clients if a particular phonebook is writeable or not and if not what validation is required Add support so raw-send and send-ack can be asynchronous Provides a Rm Socket Interface between AP and Modem for VT Support PBM support for providing the number of USIM contacts that can be associated with a contact stored on the SIM card. USIM contacts include E-mail, Additional Number, Group name and SNE CM acquires a RAT based on ECC list for emergency call and PBM maintains ECC list per RAT and provide new API for call type resolution Support loopback mode for voice packets in IMS 2.1.6 WLAN driver 2.1.7 SPI Driver 2.1.8 SSBI Driver 2.1.9 2.2 2.2.1 2KB. 4KB, and 8KB size pages SLC NAND x8 and x16 Modem Interface AT Command Support (GCF) 2.2.2 Dial-up Networking over USB 2.2.3 QMI 2.2.4 2.2.5 2.2.6 2.2.7 2.2.8 2.2.9 Multimode: QMI Add One Field toDetermine if Record is Read Only or Read-Write in QMI_PBM_RECORD_READ_I ND Multimode: QMI WMS SEND RAW Async Command Data Interface: IMS VT:

Support Rm Socket Interface between AP and Modem Modem Interfaces: QMI Provide Number of USIM Entries per Contact Multimode: Emergency Services RAT Based ECC Number Handling IMS Voice Loopback Mode Support 42 COMPANY CONFIDENTIAL 2.2.10 2.2.11 2.3 2.3.1 2.3.2 2.3.3 IMS Call Failure Code & Call End Reason Provided to UI through CM SIM Hotswap Linux Kernel and BSP Base Linux Kernel port Secure Boot Data Mover (DMOV) 2.3.4 Exception handler 2.3.5 Watchdog 2.3.6 Network Stack Support RAM File System FAT32 YAFFS2 FOTA 2.3.7 2.3.8 2.3.9 2.3.10 Call failure code & Call end reason provided to UI through CM Feature allows inserting or removing a SIM while the device is powered on kernel version supported: 3.0 SBL2 loads all subsystem firmware Driver that interfaces with the Qualcomm Data Mover hardware. Linux kernel handlers for A5 CPU exceptions, kernel panic, etc. No subsystem restart, A5 watchdog bark and bite handlers, modem watchdog bite (system resets), RPM watchdog bite

(system resets), restarts in Download mode based on NV flag Linux network stack provides IPv4 and IPv6 support RAM file system(s) supported for initrd FAT32 file system (for SD) NAND FOTA is an application used for upgrading firmware image over the air 43 Federal Communication Commission Interference Statement This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions: (1) This device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation. This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one of the following measures:

- Reorient or relocate the receiving antenna.

- Connect the equipment into an outlet on a circuit different from that Increase the separation between the equipment and receiver. to which the receiver is connected.

- Consult the dealer or an experienced radio/TV technician for help. FCC Caution: Any changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate this equipment. This transmitter must not be co-located or operating in conjunction with any other antenna or transmitter. Radiation Exposure Statement:

This equipment complies with FCC radiation exposure limits set forth for an uncontrolled environment. This equipment should be installed and operated with minimum distance 33 cm between the radiator & your body. This device is intended only for OEM integrators under the following conditions:

1) The antenna must be installed such that 33 cm is maintained between the antenna and users, and 2) The transmitter module may not be co-located with any other transmitter or antenna. As long as 2 conditions above are met, further transmitter test will not be required. However, the OEM integrator is still responsible for testing their end-product for any additional compliance requirements required with this module installed IMPORTANT NOTE: In the event that these conditions can not be met (for example certain laptop configurations or co-location with another transmitter), then the FCC authorization is no longer considered valid and the FCC ID can not be used on the final product. In these circumstances, the OEM integrator will be responsible for re-evaluating the end product (including the transmitter) and obtaining a separate FCC authorization. End Product Labeling This transmitter module is authorized only for use in device where the antenna may be installed such that 33 cm may be maintained between the antenna and users. The final end product must be labeled in a visible area with the following: Contains FCC ID:MCLT77H468. The grantee's FCC ID can be used only when all FCC compliance requirements are met. Manual Information To the End User The OEM integrator has to be aware not to provide information to the end user regarding how to install or remove this RF module in the users manual of the end product which integrates this module. The end user manual shall include all required regulatory information/warning as show in this manual.