yashsingh1/xdaforums huggingface dataset:
[Galaxy S II Q&A, Help & Troubleshooting] E:V:A:
@Rebellos:

Cool! So we're talking Bada here. But I know little to nothing about Bada.

a) What Modems do those devices use? I know the popular AP cpu's s5pc110 in the Wave, but the BPs?

b) How do you think this have evolved for the later platforms such as SGS1&2?

c) I see that many of those subroutines are still unmapped. Could it be that they're RF specific (and therefore less documented on upper layers)?

d) Have you searched any more recent RIL code for similarities?

(If not perhaps we can run a binary diff on some of it...)

e) How did you map these (function calls)?

As of today, it look like SEC is moving on to Tizen. But I'm not clear on the relationship of Android and Tizen...
[Galaxy S II Q&A, Help & Troubleshooting] Rebellos:
a) On Wave I and II BP is Qualcomm QSC6270, ain't sure about Wave III but it appears that there is single-chip Qualcomm solution, containing 2 sub-SoCs - AP and BP.

b) Abstract model remains the same for both, Waves and SGS series, you can find more general info about it by googling for oneDRAM, there are some patents by Samsung with description of AP-BP communication. But exact data offsets, buffers sizes and packet structures changed because Samsung rewritten that driver from scratch.

c) I just haven't named them yet. Most of the names I typed manually basing on debug strings printed by these functions.

d) These functions are compiled into 30-50mb APPS code (it's OS kernel + statically linked low level API), but I've made deep analyse of this protocol, and comparing to fast analyse of SGS RIL - protocol is similiar, because the purpose of it is exactly the same, but looks like both had been created from scratch.

e) As told in points above - function strings, and API export tables parsed by my handmade IDA script.
[Galaxy S II Q&A, Help & Troubleshooting] Entropy512:
I need some time to completely catch up on this thread, but:

On at least some original Hummingbird-based devices, the AP/modem interface was, at least, a pseudo-serial interface. (Even if at a low level it was not serial, it appeared to the RIL as a serial port). I can confirm this was the case on the SGH-I997 (Samsung Infuse). I had RILSpy, which relies on the modem interface being tty-based, 90% working on the Infuse - https://github.com/Entropy512/rilspy - Unfortunately I was never able to figure out a good way to intercept baud-change commands, so it was impossible to sniff the RIL/modem traffic without breaking the interface (It would crank up the baudrate to bootload firmware.) Either way, the modem interface was clearly presented to the RIL as a tty by the kernel.

On the Exynos-based Galaxy S II devices, the interface is COMPLETELY different.

On the Sprint SPH-D710, it appears to be a DPRAM interface - this is unique to the Sprint variant as it has a completely different radio setup to support CDMA2000 + WiMAX.

On the GT-I9100 and SGH-I777, it appears, as far as I can tell, to be based loosely or fully on USB for the AP/CP interface. See https://github.com/Entropy512/linux_kernel_sgh-i777/blob/master/drivers/net/usb/cdc-svnet.c

Control information (commands) and actual data (e.g. network connections) appear to be routed over different logical interfaces in this driver. (This is evidenced by the two independent wakelock mechanisms - svnet for control data, and svnet_dormancy wakelocks any time network data is transferred. Note that the svnet-dormancy wakelock timer has no actual connection with fast dormancy or any such timer within the radio.)

So any AT command set interface via USB from a Windows machine to the modem is almost surely abstracted by a HAL somewhere. Most likely this is to permit the use of the phone as a USB network device from a PC.

BTW, this USB-based interface appears to be why the I9100 and I777 have such long resume times compared to original GalaxyS devices. If you look at a dmesg, the bulk of the resume process consists of large (compared to the rest of resume) time gaps between printk()s from modem resume steps.

Oh, and this appears to be why Samsung is not yet pairing Exynos with LTE - http://www.slashgear.com/intel-shipping-xmm-6260-hspa-modem-introduces-lte-xmm-7060-14133504/ - The good news is that once Intel starts shipping the 7060, we'll likely see Exynos handsets with LTE. :)
[Galaxy S II Q&A, Help & Troubleshooting] KB_JetDroid:
I tried these AT commands on Samsung Jet S8000 which has proprietary OS which is similar to BADA.

I'm able to get responses to many commands, including Dial, Answer, Setting Internet connection, etc.

I connected the mobile to PC in 2 different ways.

First in the normal PC Studio mode (similar to Kies). Here I get a COM22 port using which I can send AT commands. This surely seems to go through Jet's OS.

For the second method I altered the USB switch (FSA9480) settings so that CP's USB port is connected. In this mode there is a direct communication between CP and PC. Here I get a COM23 port which again works for AT Commands.

So I guess modem does support AT commands directly without AP's help.

As Rebellos said previously, when AT commands sent though IPC those are parsed by CP first. But CP can also receive the AT commands directly.

Of course this is for Jet and Wave but I guess Galaxy S modem might also be capable of handling AT commands. Maybe someone can try to set the USB in CP mode (by writing to "/sys/class/sec/switch/usb_sel" file) and then try the AT commands. This will confirm it.

-KB
[Galaxy S II Q&A, Help & Troubleshooting] Rebellos:
There is pure serial (UART) interface in both SGS and SGSII between AP and CP - it is used during bootup of modem for loading first stage of modem bootloader from AP to CP. Rest goes through oneDRAM share. SVNET is rather virtual socket than serial port, between AP and CP, it is packet-based communication, not serial. But for sure SGS and SGS II AP-CP communication model is the same or very similiar.

Virtualised layers also changed between Froyo and GB releases in SGS.

I think you got misguided - SVNET-USB appears to me to be modem device, allowing to use SGS II as USB modem for PC. I think it's just router-driver for directing all packets from AP to CP.
[Galaxy S II Q&A, Help & Troubleshooting] E:V:A:
Hello and thanks a million for your useful and great insight!

Sorry for delay in responding to your post.

I can now confirm that indeed control/command connections and data/network connection may be routed on different interfaces. But not always as this depend on the particular settings of the DataRouter/MUX interface. Problem is that there are several MUXes spooking around in there. One is in the uUSB connection chip, then there is (at least one) in the AP and yet another in the BP.

Then we have the mysterious software driven interfaces playing dancing skulls with these various MUXs, like the DataRouter (drexe) and libsec-ril.so. Although many of these MUXes can be configured to operate automatically. Finally there is the (adb and PC) driver software that (can) use multiple interfaces (or USB channels if you like) to talk the talk. Very confusing.

So I have started to map out the hardware part to understand what exactly is connected to what, but that is quite crazy work, and not very reliable as my information source is completely unreliable (the SGS-2 Service Manual). I will soon post my finds separately.

I have looked in the binary code of modem.bin and the bootloader seem to already reside in there, so I'm not sure it is loading anything, unless there's a factory reset, triggering a wipe. But then again there are these mysterious "RFS" file system calls that transfers files to/from nv_ram and to SD card etc... (But I'm not sure if these "RFS" strings refers to "RobustFS" or "RemoteFS" or something else?)
[Galaxy S II Q&A, Help & Troubleshooting] E:V:A:
Some Clarifications Given & Some Needed

So it has been quiet from my side for a few days, but I

have been working hard behind the scenes to sort out a

whole bunch of things. (Like BP/MUX/AP schematics + signals,

memory layout, firmware code.) Some of these results will

soon be provided. But there is one important thing that I'd

like make clear once and for all:

-----------------------------------------------------------

Modem directed AT commands are parsed in the BP RTOS and

directly executed there. They are not "parsed" anywhere else!

Any AT command you send, is at most wrapped in some protocol.

-----------------------------------------------------------
​

But there are several protocols and transport mechanisms

available (in our case) that can be used. Which protocol

is used, depends on circumstance. For example, when you use

Samsung-IPC, to send a command to the modem, you are

doing one of three possible things:

Wrapping the "AT" command into an obscure IPC string.

Directly calling the corresponding RTOS code segment

(function call), corresponding to a particular "AT" command.

Writing directly to the various BP control-registers, with the

help of the RTOS.

[If you have any other suggestion, please let us know!]

So if someone could enlighten us, as to which one it is!?

The main reasons why the DataRouter (drexe) and various

other RIL's (rild, libril.so, libsec-ril.so and

libsecril-client.so) prefer to use IPC, are because:

Much faster transfer and processing

Freeing up the other PHY-layer transports

(UART, I2C, HSI etc) for other use.

Easier to design. (But harder to understand?)

Next we need to explore the different transport options.

[more to come...]
[Galaxy S II Q&A, Help & Troubleshooting] hpatel16:
Sending AT commands to Android devices from a PC

Hello All,

I was referred to this thread for a question I had posted on another Android forum to understand how AT command processing works on the Android platform. Let me state I am new to Android.

After reading this thread I collected some idea of how things work but I still don't have a clear picture.

If I were to develop a brand new Android device, and wanted to implement AT command support (ability to parse received AT commands and act upon them), I am trying to understand how I would go about doing that.

- When sending AT commands from a PC terminal tool over RS232 or USB, what is the route the command takes ?

- Is the AT interpreter implemented in the AP or vendor RIL or is it in the BP ?

- Do the AT commands go directly to BP or to BP via AP ?

- I read that the following comment "Android provides a reference Vendor RIL, using the Hayes AT command set, that you can use as a quick start for telephony testing and a guide for commercial vendor RILs. The source code for the reference RIL is found at /commands/reference-ril/."

Does this mean the vendor RIL itself consists of the AT parser ? Is the vendor RIL considered part of the BP or AP or none ?

My goal is to be able to come up with a simple high level architecture diagram showing where the AT parser module lies in the Android platform and the path that AT commands take from a PC terminal to the Android device AT parser.

On a separate note what is CP ? I know of AP and BP but Ive seen references to CP all over the posts.

thanks!
[Galaxy S II Q&A, Help & Troubleshooting] E:V:A:
A modem hack-pack have been released:

[XMM6260][X-GOLD 626] Modem Specification / Documentation / Hack-Pack

Nothing revolutionary, but have lots of collected good & verified info!
[Galaxy S II Q&A, Help & Troubleshooting] justforfunfun:
how write opencode video and audio data stream into nexus s modem?

I want to develop 3g video telephone APP on Nexus s using opencore 3g-324m

protocol.

I had compiled sucessful Opencore in android 2.3.4.

but how to write Opencore data stream into modem?

In android source code:

/Gingerbread/hardware/ril/reference-ril/reference-ril.c

} else if (s_device_path != NULL) {

2035 fd = open (s_device_path, O_RDWR);

2036 if ( fd >= 0 && !memcmp( s_device_path, "/dev/ttyS", 9 ) ) {

2037 /* disable echo on serial ports */

2038 struct termios ios;

2039 tcgetattr( fd, &ios );

2040 ios.c_lflag = 0; /* disable ECHO, ICANON,etc... */

2041 tcsetattr( fd, TCSANOW, &ios );

2042 }

2043 }

'/dev/ttyS' should only be wrote AT command or read respone by Ril.

OK,in that way, how to write Opencore audio and video stream into

modem?

On 3G video telephony, After write AT command : "AT+CBST=134,1,0",

the 64kbps Circuit exchange links will be established.

then how to read data from 64kbps Circuit exchange links or write

data?

has it hardware address or device name or descriptor, or something

that can mark it ?

Thanks
[Galaxy S II Q&A, Help & Troubleshooting] E:V:A:
I think you're surfing the wrong thread here. Please:

1) See the Replicant website and re-post your question there or start a new thread in the appropriate forum.

2) Edit and remove the post above, in order not to confuse other readers and waste the space...

Thanks for understanding.
[Galaxy S II Q&A, Help & Troubleshooting] highlandsun:
If your phone/modem responds to AT commands, you can use my radiooptions trick to send commands to it using the ril-daemon.

http://xdaforums.com/showthread.php?t=1037075

I used this to help write the RIL for XDAndroid on the TouchPro2. Since it's patched in at the generic libril layer, it will work with any vendor's RIL implementation, assuming they implemented the OEM_HOOK_STRING command.
[Galaxy S II Q&A, Help & Troubleshooting] Choumarin:
Hi!

Anyone managed to send AT commands to the Galaxy Nexus ?
[Galaxy S II Q&A, Help & Troubleshooting] gclear:
Dear E:V:A,

i'd like to ask if you can help me with obtaining the modem log, from sgs2 (i9100).

I'm not sure, if there are more logs, but there should be one containing "[SEC]" prefix in some lines, that's the one i'm interested in.

Thanks
[Galaxy S II Q&A, Help & Troubleshooting] llanyort:
have you ever heard of the EGMR command ? your list did not mention it.
[Galaxy S II Q&A, Help & Troubleshooting] doneel:
Advice on AT commands with Motorola Droid?

I've been trying for a while to get a response on a Motorola Droid to no success.

The echo > /dev/smd0 trick doesn't work because there is no /dev/smd0, but I've tried plenty of others (from within adb) such as /dev/ttyS0-2 and so far no signs of life.

Has anyone succeeded on this phone by any method whether pinging a device or using an RIL implementation?
[Galaxy S II Q&A, Help & Troubleshooting] ygvuhb:
i have a galaxy nexus

can i use AT+XBANDSEL

to force galaxy nexus only receive UTMS900?

if it work, can it become a app to be band selection function
[Galaxy S II Q&A, Help & Troubleshooting] xdadami:
is non transparent mode supported in galaxy S ?

Good morning

I hope this is the most appropriate thread for this question, hopefully

What I try to do: Use a PC with hyperterminal to connect to another GSM phone in data mode using a samsung S on my side.

What I have working so far:

- Can connect to the phone using hyperterminal and give AT commands, eg the command ATI reply with

Manufacturer: SAMSUNG

Model: I9000

Revision: I9000XXJW4

IMEI: 356531044617714

- can dial another phone in voice mode using the command ATDxxxxxxxx;

where the xxxxxxx is an actual gsm phone number and the ; at the end is to force voice dial

Whan I try to use the dial command in data mode ATDxxxxxxxxxx the reply I have is

NO CARRIER

at+ceer

+CEER: "CC setup error", 65, "Bearer service not implemented"

The question is: Who is not routing the call ?

- The GSM engine at the phone

- The network

- The SIM profile

I can say that I used the same SIM on a cinterion TC55i and the dial command does work, so I assume the SIM is not at fault

Just to make it absolutely clear:

- I am not trying to use Internet or GPRS

- The link is between two GSM modems in non-transparent data mode

Any pointers in getting the samsung to work ?

Thanks
[Galaxy S II Q&A, Help & Troubleshooting] autoprime:
Pulled some AT commands from the modem.bin's of the US Galaxy S III variants: SPH-L710 CDMA/SCH-I535 CDMA/SGH-I747 GSM

Some have already been covered here and here.

##3424# > Qualcomm USB Setting > RMNET + DM + MODEM. If on AOSP rom flash back to touchwiz or use GS3 scripts found in OP here. I used Windows 7 and putty.exe for the AT commands. In putty set connection to serial. Set COM port to the same port listed in Windows Device Manager > Modems > Samsung Mobile USB Modem #X. All of this is explained in the OP of this thread with the only difference being putty instead of cygwin.

If anyone's interested...

$QCMIPMHSSX
$QCMIPMASSX
$QCMIPMHSS
$QCMIPMASS
$QCMIPNAI
$QCMIP
$QCMIPP
$QCMIPT
$QCMIPEP
$QCMIPMASPI
$QCMIPMHSPI
$QCMIPRT
$QCMIPNAI
$QCMIPHA
$QCMIPPHA
$QCMIPSHA
$QCMIPGETP
$QCMT
$QCNMI
$QCSMP
$QCPMS
$QCMGR
$QCMGS
$QCMSS
$QCMGD
$QCMGL
$QCMGF
$QCMGW

^HDRCSQ
$QCOTC
$QCVAD
$QCCAV
$QCCHV
^HWVER
^RESET
^VOLT
^CPIN
$QCPREV
$QCMDR
$QCSCRM
$QCTRTL
$QCQNC
$QCSO
$QCVAD
$QCCHV
$QCQOSPRI
$QCCHS
^HDRCSQ
^SYSINFO
^GSN
^CGSN
^MEID

+CREG
+CGREG
+CRING
+CR

$QCSIMSTAT
$CREG
$CCLK
$QCCNMI
*CNTI
$QCCLR
$QCDMR
$QCDNSP
$QCDNSS
$QCTER
$QCSLOT
$QCSIMAPP
$QCPINSTAT
$QCPDPP
$QCPDPLT
$QCPWRDN
$QCDGEN
$QCPDPCFGE
$BREW
$CSQ
$QCSYSMODE
$QCCTM
$QCBANDPREF
^PREFMODE
$QCVOLT
$QCHWREV
$QCBOOTVER
$QCDEFPROF
$QCMRUE
$QCMRUC
$QCAPNE
$QCPDPIMSCFGE

$QCBCEN
$QCBCIP

$MDN
$MSID
$MIPERR
$1XRXPWR
$1XECIO
$DORXPWR
$DOSINR
$DEBUG
$ERI

+FCLASS
+ICF
+IFC
+IPR
+GMI
+GMM
+GMR
+GCAP
+GSN
+DR
+DS
+CMEE
+WS46
+PACSP
+CLCC
+CBST
+CRLP
+CV120
+CHSN
+CSSN
+CREG
+CGREG
+CEREG
+GCAP
+CSCS
+CSTA
+CR
+CEER
+CRC
+CGDCONT
+CGDSCONT
+CGTFT
+CGEQREQ
+CGEQMIN
+CGEQOS
+CGCONTRDP
+CGSCONTRDP
+CGTFTRDP
+CGEQOSRDP
+CGQREQ
+CGQMIN
+CGEREP
+CGPADDR
+CGDATA
+CGCLASS
+CGSMS
+CSMS
+CMGF
+CSAS
+CRES
+CSCA
+CSMP
+CSDH
+CSCB
+FDD
+FAR
+FCL
+FIT
+ES
+ESA
+CMOD
+CEMODE
+CVHU
+CKPD
+CTSA
+CMAR
+CDIS
+CRSL
+CSS

S0
S2
S3
S4
S5
S6
S7
S8
S9
S10
S11
S30
S103
S104

A
D
E
H
I
L
M
O
P
Q
T
V
X
Z

\Q
\S
\V
%V

&C
&D
&E
&F
&S
&V
&W

AT+SYSSLEEP
AT+VERSNAME
AT+MAXPOWER
AT+TEMPTEST
AT+SIMDETEC
AT+PRODCODE
AT+CALIDATE
AT+BANSELCT
AT+SECNRSSI
AT+READRSSI
AT+SCMMONIT
AT+TESTMODE
AT+GPSSTEST
AT+MSLSECUR
AT+IMEITEST
AT+AKSEEDNO
AT+LIFETIME
AT+IMEICERT
AT+LVOFLOCK
AT+DETALOCK
AT+LOCKREAD
AT+CFUN
AT+MEIDAUTH
AT+CHNSELCT
AT+AOTKEYWR
AT+FACTORST
AT+BAKUPCHK
AT+NAMCHECK
AT+PRLVERIF
AT+ERITTEST
AT+RECONDIT
AT+KSTRINGB

More AT command references...

Qualcomm AT Command Set in Gobi

AT CommandsFor CDMA Wireless Modems - Reference Guide

Telit CC864-DUAL AT-Commands Reference Guide
[Galaxy S II Q&A, Help & Troubleshooting] E:V:A:
Now the 1,000,000 $ question. Are you able to access modem from a local terminal shell?

I.e. By not accessing modem via external PC connection (adb + com ports).
[Galaxy S II Q&A, Help & Troubleshooting] The-Captain:
Thread Cleaned per OP's Request.

Please keep this thread on-topic. Thanks.

~ The-Captain
[Galaxy S II Q&A, Help & Troubleshooting] zad522:
Hi guys,

I ran serial connection on HTC One X, Galaxy Nexus, and Nexus S in adb shell:

# busybox microcom -t 5000 /dev/ttyGS0

But none of them give me any feedback. Do you guys know is it possible to send AT commands to the baseband in adb shell?

BTW, I also try to create serial connection from Windows 8 PC. However, I cannot find "SAMSUNG Mobile USB Modem" under Modem in Device Manager. So could anyone tell me how to enable samsung modem in Windows.

Thanks,

Andong
[Galaxy S II Q&A, Help & Troubleshooting] autoprime:
I've been wanting to send AT commands while using OS X and came across this guide... it works. thought I'd share.

http://brunomgalmeida.wordpress.com/2012/04/06/send-at-commands-to-usb-modem/

still haven't figured out how to send AT commands on the device itself :(
[Galaxy S II Q&A, Help & Troubleshooting] RussianBear:
Is it possible to issue a command that would forward the sms (text message) to a different number automatically? Call forwarding is pretty straight forward, what about the text messages? Just got a at&t elevate hotspot and trying to tinker with it. Downloaded some soft called "sms enabler" and it has that forwarding option (the modem has to communicate with this soft at all times, though).

Any tips are appreciated!
[Galaxy S II Q&A, Help & Troubleshooting] E:V:A:
I think you can imagine how this works. There's no such thing in AT command set for this, and there's no public firmware hack available either AFAIK, and it would not be necessary as you could simply have an app that automatically forwards all incoming SMS's. Basically this means that your just copying and sending a new message to the other number. This is obviously not how call forwarding works.The only other choice is if you have your own BTS with modified firmware...
[Galaxy S II Q&A, Help & Troubleshooting] saykou:
New info

I'm sorry but i can't post any of the images i had for this post, because i'm new to xda , so all the images are in the post from E:V:A after this one, labeled 1,2,3

I think i unveiled some more info, I'm a noob at xda, why not share ...

My logcat in my galaxy ace logs the usb communication, from the host to the device.

So for example if i start kies software, that uses the AT commands to get information and start service, from the host to the device, everything get's logged on the logcat, this is how it kinda think it works. Also beware that i'm not an hardware expert, or low level system expert ...

for example:

[image 1]

Image above shows an example of the how the at communication, there's such a system process called dun_mgr that handles the communications from the usb to the atx process. dun_mgr get's the commands, and sends to atx, this one executes it, and responds to the dun_mgr. Atx process logs, with AT label when it's an at command, and logs with ATX label when it's a atx command .. duh .

For example if there's some kind of filtering in commands, dun_mgr does it. no issuing the command to atx, like in the image below.

[image 2]

What's amazing is that the kies software uses the at command to sync, the command

AT+DEVCONINFO

returns a whole bunch of code about the device, like imei etc, mounts the sd card, and start the kies_service in the device.

The kies software like said, uses AT commands to communicate and to "handshake", then it start's an NPS_MOBEX service, and everything from there is done differently. It still uses the at command or rather the atx, but i guess is some how encrypted, since the the atx process logs

pc_sync_write

, and nps_captures the message, and does something.

Like in image below

[image 3]

After nps_mobex starts, the dun_mgr doesn't log anymore, so i'm guess, atx or nps_mobex use some sort of socket's ???

I would like to unveil more of this. I tried to disassemble the code in atx, and dun_mgr, but i can't understand it much, aside from a few switch cases it does.

Further work on this would be great.
[Galaxy S II Q&A, Help & Troubleshooting] E:V:A:
Here you go. Please edit your post to put the image numbers (below) in it.

Image [1]:

Image [2]:

Image [3]:
[Galaxy S II Q&A, Help & Troubleshooting] saykou:
Turn donwload mode on

Upon issuing the commands over USB AT+FUS download mode, don't know why it is there.
[Galaxy S II Q&A, Help & Troubleshooting] E:V:A:
That's not very helpful. If you have any suggestion please explain or don't bother posting.
[Galaxy S II Q&A, Help & Troubleshooting] brok85:
galaxy S3 AT commands

Hi!

thanks for the useful post!

I am using a samsung galaxy S3 (sgh-t999) for my project. My purpose is talk to the baseband modem directly to answer an incoming phone call.

I have connected the phone to the desktop through the usb. I started the hyperterminal on the desktop and typed

AT

and received OK from the modem. Next, I tried to call my phone and after seeing the call on the display, I typed on the hyperterminal

ATA

which correctly answered the call. Next: I turn-off RILD (the process on the Android OS that handles the radio communications between the application processor and the baseband processor) with the command

stop ril-daemon

on the adb shell of android. I type again

AT

and the modem still reply OK. I tried to call my phone again and instead of receiving RING as before, I receive +CLIP,phone_number,...

At this point I try to answer the call with ATA but the modem reply me

NO CARRIER

even though from the calling phone I can hear the ringing...why is that? why turning off RILD does not allow ATA to go through?

thanks for any help!