[Android Development on Bada] Rebellos:
Thank you very much Raitis

Well, the bad thing here is that we don't know about Android device with similiar modem drivers. That means these have to be written almost from scratch in our case. My analyze is growing. But we don't need to implement everything at once to get simple GSM & Fuel Gauge functionality. I also believe some packets aren't even used, but bada is able to parse them, because Samsung's proprietary AP-CP protocol does require that.

For now I've got this:

Class-IDs
AnsiC	0x1000000
SysBase 0x1000001
DevUart 0x1000033
DevUsb	0x1000034
FotaMgr 0x10000F5
DevOBEX	0x10000C6
DevWIFI	0x10000F2
DevNDIS 0x10000FA
DevFIFO 0x1000014

IRQ gpio = (short*)((IRQ_ARRAY+int_num*24)+4)

DrvTask Packets:
19 OemPhsBattLevelChangeInd
20 battRelated
21 battRelated
22 battRelated
48 OemPhsBattGaugeChangeInd

Modem calls order:

Modem Dispatchers:

ShpModemNvTask, type 151
DrvIpcDataTask, types 153, 155
DrvIpcLogTask, types 157, 159
ShpReqBrkFifoTask type 148
ShpFifoTask default case (all other types)

packets AP->CP (alot of CP->AP packet headers are the same or similiar)

PACKETTYPE 0x2 SimPacket
###

PACKETTYPE 0x3 ProtoPacket
###

PACKETTYPE 0x4 TapiPacket
###

PACKETTYPE 0x6 FmPacket
###

PACKETTYPE 0x9 SoundControl
56b 0x0, <data>

PACKETTYPE 0xA VoiceCapture (DrvVI)
###

PACKETTYPE 0xF GENERIC_PACKET (Bootmanager packet)
AP_GOES_SLEEP	0x0	4b
COLD_RESET	0x2	4b (not sure, may be internal, its not implemented anyway)
POWER_OFF	0x3	4b
AP_GOES_AWAKE	0x6	4b
LPM_SWITCH	0xB	8b | long 1/0 (ON/OFF), bada use only ON
SET_LAZY_SW_VER 0xC	24b | char sw_ver[20]

PACKETTYPE 0x19 MULTIPACKET
###

PACKETTYPE 0x1A DiagSetSubDiagnose
24b <some info like apps, modem, shp ver stored in apps>

PACKETTYPE 0x2E SetDebugLevel
<dbg_level> (no heading, so packettype is header) 4b

PACKETTYPE 0x31 NvPacket
###

PACKETTYPE 0x32 LbsPackets (Location Based Service)
###

PACKETTYPE 0x33 QMochaSimPacket (Jsr177)
###

PACKETTYPE 0x34 DsmPacket
###

PACKETTYPE 0x91 BluetoothPackets
<packetlen> ###

PACKETTYPE 0x92 TestModePacket
<packetlen> ###

PACKETTYPE 0x93 IpcPacket
<packetlen> byte type; byte[] buf;
type	buflen
0x3 NvBackupRead	dynamic, contains N bytes from 0x1E700000, requested by IpcPacket of type 0x1
0x4 ModemReset?	0x4 (always NULL)
0xA Unknown	echo the packet we got, requested by IpcPacket of type 10
0xB NvBackupWritten	0x4 (always NULL), sent in case of success overwriting of 0x1E700000, buffer to write is probably sent from CP in IpcPacket of type 0x2
0x17 PmicThing	0x4, contains return val of sub_4007DC04(0, data_from_cp), requested by CP in IpcPacket of type 0x15 (followed by data)
0x18 PmicThing	0xC, contains data_from_cp after calling sub_4007DC04(1, data_from_cp), requested by CP in IpcPacket of type 0x16 (followed by data)
0x1A TA_Change	0x4 (1=insert, 2=remove, 0xB=unknown), not sure->{sent only if some condition is met, this condition is set to true by TA_Remove_NotifyCP}
0x1D SoundConfig	0x19C (412), send 4 in row, on CP request probably
0x28 DiagTrace?	dynamic, probably used only in debugging
0x34 CamTestMode	0x4, contains int passed to DevFTMCamDeviceTestResponse or 1, if called from OemTestMode
0x36 HeadsetKey	0x4 (1=press, 0=release), only for keycode=0x8A, which is headset button
0x38 LbsATCmdReq	dynamic, no damn idea for now, invoked in OemLbsATCmdRequest
0x3A WlanINFO	0x9, byte 0x89, byte WlanTmPowerOn, byte WlanTmPowerOff, byte WLAN_MAC[6], requested by IpcPacket of type 57, this packet can contain MAC or smth probably
0x3C WlanTest	0x8, byte 0x86 and some ****
0x3E WlanMFGResp	0xB|0x14, response to WlanMFGCommand
0x3F NvWriteItem	0x7C(124), <writeinfo buffer>, sent to confirm/write(have to check) NV item write, buffer[0]=short(0x2758), buffer[4]=short(newValue) OR buffer[0]=short(0x2757), buffer[4] = string(14)(newValue)
0x44 HiddenSWVer	0x14 (20), send after AppsSettings
0x4B CompassData	0x9, probably reading of compass, requested by IpcPacket of type 74 followed by 1 byte (equal to 1 or 2 or else (3 or 0 maybe, doesn't matter))
0x4C DrvStat??	0xCC (204)
0x49 LbsThing	0x6, contains databuffer generated by sub 4012DE64 GenerateLbsDataMaybe, requested by IpcPacket of type 72, first byte != 1 and first byte != 0
0x4E BootInfo	0x1, contains byte from (SharedBootInfo+0x3C), no idea what's that, requested by IpcPacket of type 77
0x50 PS_STOP	0x1, result of proximity_sensor_detect_start, requested by IpcPacket of type 79
0x52 PS_START	0x1, result of proximity_sensor_detect_stop, requested by IpcPacket of type 81
0x54 PS_IS_CLOSE	0x1, result of proximity_sensor_is_close, requested by IpcPacket of type 83
0x55 WakeUp??	0x4 (always NULL) No idea, send from complicate math from 2 subs: PhsStatus and from BmWakeUp (right before 0xF packet AP_GOES_AWAKE to FIFO)
0x57 TSP_related??	0x2, , requested by IpcPacket of type 86 followed by probably 3 bytes
0x58 TA_Info	0x2, short int with some USB connector status (not dived into that yet, but normal value seems to be 1 or 2) requested by IpcPacket of type 88

0x5A OTHERS O.o	0x7, string "Others", requested by IpcPacket of type 89, My damn favourite one!
0x5C FOTA_Update	0x3|0x7, string "OK"|"FD"|"FC", or "FMA"|"FMB"|"FMC"|"FTA", requested by IpcPacket of type 91
0x5E FOTA_related	0x0, requested by IpcPacket of type 93

0x Unknown	0x1, , requested by IpcPacket of type 100

PACKETTYPE 0x94 RbmPacket
<packetlen> ###

PACKETTYPE 0x95 DevMgr
<packetlen> | long <unknown> | long packetType | char* packet_buf

PACKETTYPE 0x96 SysSecureBootPacket
SET_IMEI	0x2	33b?? long 0| long 0x11| long 0| long 0| long 0| char imei[9] | byte 0 | byte 0

AMSS_RunReq
Reset semaphore (set to NULL)
Send magic 0x89EF89EF through AP->BP semaphore
GPJ0(0) = output, HIGH

CP->AP
IpcPackets
type	buf
41 Unknown, possibly dummy
45 SetLcdState	0x1, bool on (1 = wakeup, 0 = goto sleep)
46 VibStop	0x1, unknown
47 BtTM
48 BtTMRsp
51 CamTM
55 LbsATCmdReq
57 ReqWlanInfo
59 ATCWlanTest
61 WlanMFGCmd
95 WlanMAC	0x6, byte[6] WLAN MAC address from NV
98 BattGaugeChangeInd, writing data from packet into batt driver struct and signaling DrvTask

And I'm starting to look into AMSS. Already got concept of correct NV data injecting. I will start tests with Oleg as soon as we get GB port to base functionallity. We have to start from clean I9000 alas. :(

The good news is that Oleg found almost 100% valid S8530 LCD drivers (for the screens with

I will probably slow down with work for some time now, first exams on university and would be not really good for me if I fail on these. ^^

//edit:

changed "full functionallity" to "base functionallity"