[Streak 5 Q&A, Help & Troubleshooting] hunderteins:
Problem solved: Look into http://xdaforums.com/showthread.php?t=1558089

Hello,

this ussd problem with gingerbread-roms drives me nuts. Codes like *100# won't work. I have to stay on froyo to check my prepaid balance and recharge.

Thanks to nop who narrowed the problem down to libril-qc-1.so, I (s)traced rild and found the following difference:

2.2.2 rild:

[pid 138] writev(11, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril.c 2079] UI --- RIL_REQUEST_SEND_USSD (29) ---> RIL [token id 256, data len 4]\n\0"..., 86}], 3) = 93

[pid 138] writev(11, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_cm.c 14003] USSD string in UTF8 format = *100# length = 5\n\0"..., 66}], 3) = 73

[pid 138] writev(11, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_cm.c 14008] USSD string is in ASCII format, converting to 7BIT format\0"..., 78}], 3) = 85

[pid 138] writev(11, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_cm.c 14023] USSD string after conversion = *100# length = 5\n\0"..., 68}], 3) = 75

[pid 138] writev(11, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_reqlist.c 216] Not found ReqList entry waiting for CM_SUPS_EVENT_USS_IND (86035)\n\0"..., 89}], 3) = 96

[pid 138] writev(11, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_reqlist.c 169] Not found ReqList entry : token id 256\n\0"..., 62}], 3) = 69

[pid 138] writev(11, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_reqlist.c 400] Event RIL_REQUEST_SEND_USSD (29) pending receipt of CM_SUPS_EVENT_PROCESS_USS_CONF, token id 256 [0x2ae68]\n\0"..., 130}], 3) = 137

[pid 138] writev(11, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_reqlist.c 1065] ReqList entries : \n\0"..., 43}], 3) = 50

[pid 138] writev(11, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_reqlist.c 1071] RIL_REQUEST_SEND_USSD (29), token id 256\n\0"..., 69}], 3) = 76

[pid 138] write(17, "\n\0\1\200\0\0\0\0\375\1\0\0\0\0\0000C\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 40

[pid 138] write(24, "\0\0\1\375\0\0\0\0\0\0\0\0020\0\0\0\263\277\333\31\0\0\0C\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\27\0\2\256h\0\0\0\27\0\0\0\1\0\0\0\6\0\0\0\1\0\0\0\17\0\0\0\5\0\0\0\5*100#\0\0\0"..., 84) = 84

2.3.3 rild:

[pid 3372] writev(10, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril.c 2577] UI --- RIL_REQUEST_SEND_USSD (29) ---> RIL [RID 0, token id 59, data len 4]\n\0"..., 92}], 3) = 99

[pid 3372] writev(10, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_arb.c 1437] RID 0 voice srv: modem id=0, ma=Multimode(0), net_pref=GSM WCDMA preferred(0)\n\0"..., 98}], 3) = 105

[pid 3372] writev(10, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_cm.c 22350] USSD string in UTF8 format = *100# length = 5\n\0"..., 66}], 3) = 73

[pid 3372] writev(10, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_cm.c 22358] USSD string is in ASCII format, converting to 7BIT format\0"..., 78}], 3) = 85

[pid 3372] writev(10, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_cm.c 22375] USSD string after conversion = *100# length = 5\n\0"..., 68}], 3) = 75

[pid 3372] writev(10, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_reqlist.c 331] [RID 0] Not found ReqList entry waiting for CM_SUPS_EVENT_USS_IND (86035)\n\0"..., 97}], 3) = 104

[pid 3372] write(18, "\n\0\1\200\0\0\0\0\354\0\0\0\0\0\0000\201\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 40

[pid 3372] write(23, "\0\0\0\354\0\0\0\0\0\0\0\0020\0\0\0\263\277\333\31\0\0\0\201\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\4*100\0\0\0\4\0\0\0\1"..., 60) = 60

[pid 3372] futex(0x80317f74, FUTEX_WAIT_PRIVATE, -40, NULL <unfinished ...>

[pid 3377] <... select resumed> ) = 1 (in [23])

[pid 3377] rt_sigprocmask(SIG_SETMASK, [TRAP BUS FPE KILL SEGV USR2 PIPE ALRM TERM CHLD TTIN TTOU RTMIN], NULL, 4) = -1 EINVAL (Invalid argument)

[pid 3377] read(23, "\0\0\0\354\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\4*100\0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 17408) = 84

Basically the rild on gingerbread 2.3.x isn't sending the last character '#' to end the ussd correctly. Ironically in "logcat -b radio" rild states that the ussd it will send is 5 chars long, but it sends only 4 chars over to the character device /dev/oncrpc/30000000:b3bfdb19

I think, this is done in libril-qc-1.so in function qcril_cm_supsvc_request_send_ussd but I was missing at school when they tought us arm-assembler, so I'm stuck reading objdump -d libril-qc-1.so.

So my first questions: Is this really a off by one bug? How can I circumvent it without the sourcecode of libril-qc-1? Is there a Qisda SDK out there for the austin baseband or libril?

On the other hand I read at http://code.google.com/p/synergy-evo3d/wiki/Radio and http://fabiensanglard.net/cellphoneModem/index2.php how to talk to the baseband without rild. And on a 2.3.x I got a positive result with

# cat /dev/smd0 &

# echo -e 'AT+CUSD=1,"*100#",15\r' >/dev/smd0

OK

+CUSD: 0," Aktuelles Guthaben: 20.10 EUR.",15

So ussd with /dev/smd0 works, but it seems libril-qc-1 doesn't use it at all. At least I can't find any AT-commands in it.

Second question: Is /dev/smd0 some obsolete way of communicating with the baseband-radio?

I appreciate any help, cause I'm somewhat stuck and can't find the loophole.

Reg. hunderteins